<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="57156">
<package pkgid="90a4c1eef24fffa5d16710208dbad897879004b151f4094d13d04751011748f8" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="8dcb5fe77d19696a94ca9e848cbc8eb2b85cc0c746af46c68e364085c6064289" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="2d39c7af4e8c9244ac35aa9dce85c2b85771614bb9afd50487384a61eedee5ed" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="3000eb82047e37557daf08f4f148058c4da742218b775d3f0e01c86e8cd82ca0" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="0533927276e35ad63cfc368d2bc4fea1e73d93a145d60cd6cd389e1ed83f7f2b" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="1410649bb81d070e1859dc9d29b49336e46ed951029f6f82b432c3ec9484ac5c" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="1940d036f1828718df1aa8a5978ceefcac68e24b19c66d75fe362fc600fb4457" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="584de6deddf0322474c6898388605ff4b6b10c55c989cc79a6eb29c6fa83daa1" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="ca84a817bbdecdaf04fe9e2bc4f4821102c1b563bab0629c38864957e55fe2d4" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="13bd7092a72f85201b6a7dd1c6a97ceeb39780f8af17b07ff13029e84b77d58e" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="28c7f7d2b324fcba03e60e315111751b32e409f1c80aa886f33b041bfedb6433" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="efb95d8c6c8f92b8a23fd1797727c4d3884456649117091d6c3e1849cbe7b87f" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="f41b300e316bc816695bfb6fbea43eb09efa8d3555a62b8ae7db3f60b0567a4b" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="e0baf85bcad54dd36c2efac4de84f079c68c335fcd57618b0d6b11e851d08d58" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="be432ea8dc619a55377d51d9eb693ffbbbd874b14842f1ed01eb433632be8a81" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="8eea50141c4e1ed5892f5c6a2ad131e0d0b62e286a5cfc7d490da44d09c361f5" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="61befbcfbfcb506b2a98cfa0fe790980f2b463bcef9a00da0b9377114f000c26" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="7d4acbfa60e647d92d875ffa6b02ce5efa3847d7c76248100b794eb771d54116" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="f8ed2ffe702d6c1e2d895196315a8b95af7eca4a7b190b02a5a5946619e5efe6" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="c4766dbeefd2cac7ab22dabda54d2df11c68249bbca9abf6b4b7b0b2da44dcc3" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="be5a2c90fd70cec70ececf111b8f71b3512629bd49494639331cdd797d4254d8" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="ef68620829eaa116382239c47f0fe5547850299d92f1b49767daa70c3446d39e" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="e324b2d8514ee6f37187e84ec1eadd6fd26ea3e123a3edbdb361d020d9e77d68" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="c6d5a36d5a292df7eb950f69c770b09e2542d321530c9da3b8cbeb515256f25a" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="31e469eff44e206bbd8c4cac3cf0b05106217d22f9b26763d3444bbe09f78c2a" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="2f2f867611b857185d715a53d7292f0eb8610088c8428fb7c816455cc420de02" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="305797ddf946f780b82f857554d1308a765a5144fff28d51df320422f3c16d78" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="69c20799e5eaa0509150d131d12fb27801c439d6e3fec10aa2ae0c22af2cd0db" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="f6e5cc693b34513b965aa8b379f4efab572cdaf9cf025628b3d1610cc993acfa" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="c3c8281dd0a11977e2513eff4ecbf3704b632641fc8489d1e7f70824ccd2a7ce" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="b7eb7c86639e7c922870927d55dbc703ba7a520570aca2ca2aa9c1f558f53142" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="8be785395a603347d0dc58588a9c35280146e93b6ee38a2477eb56401575370c" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="769ca0c833413ee1c858d77e9e766863129b4710457aad72eb3c39a777ea6d05" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="7ce3d2661c2157fb1a67487b777f4b268cb172adfd2be398702fdd894afbe998" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="75678a944cd0c8974e3e8e6a930a8d1a4f487a81d5985febe2126f82fff8c9bb" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="82175cc1adf10c05577f46494bada109dff76d5c79c615927d27f04a734afdab" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="234b9d472833404985401014ac6a1f41213fc1430eeb4c5ac0ca364be3c7d691" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="16f63eec5c2f7afd5f6b36aa2680d66b4e3d32a4b983406fcad5cafdb3fa2725" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="d133aaa12e6a8405eeee2732e19d2afb86a73bbaad10889166ed22b0dca0d54f" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="e223f1dd5ac9d2e42ba16d23fa111d1127e40e7137f4f5c8e8b473eea2f16491" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="596ab2b8c15861939ee9bbb882fde61dbde1d987336d7468d2bae9e623c36b7f" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="633ed18a15c071bd4467fe4cf239325743aeabd775cfaf33948966564bc39897" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="7524de407a818b5e2a3985476ff8ad12f13507769d905d94367c2b1abe6928c2" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="b5afceabe495306aaa6d714e9dd1d5770f9fe2e146669b94ca372a5a2dd4271f" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="332eb9b648fa3310535bd3817611849e637e4fc1792e9d6efc600196d8e2dfd7" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="ab9664d5ea386f4a202ab1e8e1449db5cb52be591045a4d846a3c8a710b34537" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="43558fb917b9ab64a4280049bf2f55ab1868e7a5dad4ffbe89ae75f1bfae7530" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="df3d88e9a6aafbb927ff3daf8c9ca0cc3b8bb6dc6f4bb8e46e443a963d3e9b16" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="8a17934b7b89167f880972f8e33991fa8f23e216cc1cbfc7a4acb0fb716bc7bd" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="1ac85cccea1d2b10494bb4563b96c7ad571f85abf09278f7465f67dce84cd441" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="8d05db826f3612c8c1fab6f1a1a9c4542ea7d69abe8359318cb08329d8fca2fa" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="62fb06c255fa8125d05862a71891377a5585bde96aa2d38bb065a496c1a3e79f" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="b0a5c83de6b5b990a8654609b8e408a3cd5ca5b98abaeca583ecf7760db01141" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="7c4fb34787a3601c3d01f986d3b521d2143607365d39c7e1b4ab4bbfdd9bc696" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="61b16102bfe52d2a8d98ac9852e80df165f8c7076b8c5b01c2a7d2a91ea5fe12" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="72bdadba53e617fac0f65284a380c6632e2b25aba57eb9e779a04cc997ea1eb9" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="f147d7ca2021bdfeb0a205854e8be1524be8bed1e2060fc7195db6c3f4ea80dc" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="4b70b2c8f0e6aa3337c485fd9e00fda8f7a733fc3245861053acded15c032043" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="c799f4f0bdf5660a39b9ce6674ae0c0cfa1f273a4599e0814cd8a3cbec4ab260" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="fe1efe9ca1baac1f0407a769eb7e5a52faef4ab6fc49f96f079aa629dae8add0" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="9e7836de579966c1d7ee1cb57e70e1dce8a32d5afdd6f76f41dc7ed2d3750408" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="86f58848dabb7396029383b2fb7a578a8d2e4f502884999a3c70b83be76c0e55" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="58e5ebee9deead66dd54c3f2030424372447cbd1b7dde2c3c1be8df85d8655f6" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="af742848b6666d7962452b3dc2a90c3bee73862d4ebff4034dc385a7d9347e34" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="d891e365889143ae8d869e66859e5d71cae3457383bc87b62aeb862907737f69" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="03e6816aa1f75085a5c4d6ac4a109b6b4c6a631f9eb304af52a7d8700fee275b" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git28.b12c72226" rel="150300.3.12.1"/>
  <changelog author="william.brown@suse.com" date="1591012800">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
</package>
<package pkgid="2f045f7f5438b38bc4c01432d4b14a42407004b022675c3cda77ee69f701c24d" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="bbd7bfa6e4d3efff0354f6a1e79594f23e2490c71154cb6e84113da791a377a8" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="6007845168d2dd7c75194654aec1aa21c0a162f9b2ec71f19a8a293a848610b8" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="bed0c8f560be12f55ec21c255c9dabe35709c702efd46db31436ca7399028327" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git38.9951c1101" rel="150300.3.17.1"/>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
</package>
<package pkgid="18a0796eeef380432e8ce4524efdef94f3a5424f3eabdc1918751f7598793a07" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="12001f144c4807f7b6e6c4d0f5d339bca21ed396bc78589003ef74dc658b1457" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="89e893f2109427f239a73619dea5ce27dc379b111a809496243e51b1bd0a5f26" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="fb660677f0ffe3fbb986edab1e130a4ae2c28a091bef2fff9336b842d226a3c2" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git46.c900a28c8" rel="150300.3.22.1"/>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
</package>
<package pkgid="f07465131f8ba9d8bd81aec621a2151f2937c04c95f4d5ca50760ad8656e3614" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="43babc9cb745426911c7041feb617c1fb173673e3403f5f2ddd2f7db79d4737d" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="a59100335a3558d00330e10459e0d5e8d67c8c8739ab84073f30b0ddf4b29dcb" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="13a3332462ecbebd798b85b49de238385dd45f353cfbd6d8b750a83608cc227a" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.19~git59.136fc84" rel="150300.3.27.1"/>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
  <changelog author="wbrown@suse.de" date="1641816000">- bsc#1194084 - resolve multiple index migration bug
- Update to version 1.4.4.18~git5.a46217a05:
  * Issue 5092 - BUG - pin concread for el8.5
  * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
  * Issue 5079 - BUG - multiple ways to specific primary (#5087)
  * Issue 4992 - BUG - slapd.socket container fix (#4993)
  * Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
  * Bump version to 1.4.4.18
  * Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
  * Issue 5046 - BUG - update concread (#5047)
  * Issue 5043 - BUG - Result must be used compiler warning (#5045)
  * Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections</changelog>
  <changelog author="william.brown@suse.com" date="1641816001">- Resolve boo#1194068 by adding required schema</changelog>
  <changelog author="wbrown@suse.de" date="1647950400">- Resolve bsc#1197345 - CVE-2022-0996 - Mishandling of password expiry
- Update to version 1.4.4.19~git21.feb4a55d8:
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)
  * Issue 5189 - memberOf plugin exclude subtree not cleaning up groups on modrdn
  * Issue 5188 - UI - LDAP editor - add entry and group types
  * Issue 5184 - memberOf does not work correctly with multiple include scopes
  * Issue 5186 - UI - Fix SASL Mapping regex validation and other minor improvements
  * Issue 5122 - dsconf instance backend suffix set doesn't accept backend name (#5178)
  * Issue 5160 - BUG - x- prefix in descr-oid can confuse oid parser (#5161)
  * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109)</changelog>
  <changelog author="wbrown@suse.de" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 1.4.4.19~git28.b12c72226:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges
  * Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)
  * Issue 5193 - Incomplete ruv occasionally returned from ruv search (#5194)</changelog>
  <changelog author="wbrown@suse.de" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query
  0001-Fix-ACI-bypass-in-shortcut-filter-condition.patch
- Update to version 1.4.4.19~git38.9951c1101:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5098 - Fix cherry-pick error
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="wbrown@suse.de" date="1658232000">- bsc#1199908 - Improvements to openldap import with passwold policy present
- Update to version 1.4.4.19~git43.8ba2ea21f:
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5276 - CLI - improve task handling</changelog>
  <changelog author="wbrown@suse.de" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 1.4.4.19~git46.c900a28c8:
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5284 - Replication broken after password change (#5286)</changelog>
  <changelog author="wbrown@suse.de" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 1.4.4.19~git48.d4c4ff1:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 5221 - fix covscan (#5359)
  * Issue 4984 - BUG - pid file handling (#4986)
  * Issue 5353 - CLI - dsconf backend export breaks with multiple backends
  * Issue 5126 - Memory leak in slapi_ldap_get_lderrno (#5153)
  * Issue 5304: Need a compatibility option about sub suffix handling (#5310)
  * Issue 5302 - Release tarballs don't contain cockpit webapp</changelog>
  <changelog author="wbrown@suse.de" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 1.4.4.19~git57.25311ff:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5345 - BUG - openldap migration fails when ppolicy is active (#5347)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 5032 - Fix OpenLDAP version check (#5091)
  * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) (#5456)
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"</changelog>
  <changelog author="wbrown@suse.de" date="1666958400">- bsc#1204748 - Resolve issue with checklist post migration when dds is present
- Update to version 1.4.4.19~git58.9af9f92:
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)</changelog>
  <changelog author="wbrown@suse.de" date="1667995200">- bsc#1205146 - failure to migrate from openldap if pwdPolicyChecker present
- Update to version 1.4.4.19~git59.136fc84:
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)</changelog>
</package>
<package pkgid="9e52fa8fa2a0b792c03d6971b24fd04d69ed1b586d6b46cb4bb75d3355c40f64" name="ClusterTools2" arch="noarch">
  <version epoch="0" ver="3.1.1" rel="8.6.1"/>
  <changelog author="fabian.herschel@suse.com" date="1333540800">- first changes to get package technical preview ready</changelog>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
</package>
<package pkgid="f9dae55e7e509f29b910b238cc7910b871258b01d03b874457ddbfaafb35a120" name="ClusterTools2" arch="src">
  <version epoch="0" ver="3.1.1" rel="8.6.1"/>
  <changelog author="lars.pinne@novell.com" date="1314705600">- added wow on-fail-block, added supportconfig plugins</changelog>
  <changelog author="lars.pinne@novell.com" date="1316692800">- added xmstat, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317297600">- moved add_softdog_to_initrd to add_watchdog_to_initrd, added grep_cluster_patterns, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317816000">- added grep_cluster_transition</changelog>
  <changelog author="lars.pinne@novell.com" date="1319198400">- added lsoflog, merged separate crontab and logrotate to one ClusterTools2, fixed grep_supportconfig</changelog>
  <changelog author="fabian.herschel@suse.com" date="1320235200">- 2.2.10 package version</changelog>
  <changelog author="fabian.herschel@suse.com" date="1321012800">- 2.2.11 st martin package version (11.11.2011)</changelog>
  <changelog author="lars.pinne@suse.com" date="1321358400">- more grep patterns, minor fixes</changelog>
  <changelog author="lars.pinne@suse.com" date="1328875200">- eDir back again</changelog>
  <changelog author="lars.pinne@suse.com" date="1332504000">- grep_supportconfig for Oracle and s390x</changelog>
  <changelog author="fabian.herschel@suse.com" date="1333540800">- first changes to get package technical preview ready</changelog>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
</package>
<package pkgid="46a75c64d0213bb45a851f8f05b01d679f4002c969c89cfe9bdd20e8fc09efac" name="ClusterTools2" arch="noarch">
  <version epoch="0" ver="3.1.2" rel="150100.8.9.1"/>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
  <changelog author="abriel@suse.com" date="1648468800">- change version from 3.1.1 to 3.1.2
- As newer versions of pacemaker display the output from command
  'crmadmin --quiet' on stdout instead on stderr, the command
  'cs_clusterstate' was enhanced to adapt these change.
  (bsc#1188652)
- Adapt 'cs_show_scores' to support newer versions of pacemaker
  and crmsh
  (bsc#1188456)
- man page updates</changelog>
</package>
<package pkgid="7c6bfe28759de6f635998a43d2e86a7887da915c30265a3ca6fd7ad6998dce49" name="ClusterTools2" arch="src">
  <version epoch="0" ver="3.1.2" rel="150100.8.9.1"/>
  <changelog author="lars.pinne@novell.com" date="1316692800">- added xmstat, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317297600">- moved add_softdog_to_initrd to add_watchdog_to_initrd, added grep_cluster_patterns, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317816000">- added grep_cluster_transition</changelog>
  <changelog author="lars.pinne@novell.com" date="1319198400">- added lsoflog, merged separate crontab and logrotate to one ClusterTools2, fixed grep_supportconfig</changelog>
  <changelog author="fabian.herschel@suse.com" date="1320235200">- 2.2.10 package version</changelog>
  <changelog author="fabian.herschel@suse.com" date="1321012800">- 2.2.11 st martin package version (11.11.2011)</changelog>
  <changelog author="lars.pinne@suse.com" date="1321358400">- more grep patterns, minor fixes</changelog>
  <changelog author="lars.pinne@suse.com" date="1328875200">- eDir back again</changelog>
  <changelog author="lars.pinne@suse.com" date="1332504000">- grep_supportconfig for Oracle and s390x</changelog>
  <changelog author="fabian.herschel@suse.com" date="1333540800">- first changes to get package technical preview ready</changelog>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
  <changelog author="abriel@suse.com" date="1648468800">- change version from 3.1.1 to 3.1.2
- As newer versions of pacemaker display the output from command
  'crmadmin --quiet' on stdout instead on stderr, the command
  'cs_clusterstate' was enhanced to adapt these change.
  (bsc#1188652)
- Adapt 'cs_show_scores' to support newer versions of pacemaker
  and crmsh
  (bsc#1188456)
- man page updates</changelog>
</package>
<package pkgid="ffffb4f9c43dfaf608f400024ff08e1986d325a761f6979e94d4d471d58137f7" name="GraphicsMagick" arch="aarch64">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="53ef3b67c2ece8545be154af985df4ee63a93eba15c57a93b61548517571ea63" name="GraphicsMagick" arch="ppc64le">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="937bfc6047989a4f4f898870de90b2e452b34ed51656a03d479aad77b3db5330" name="GraphicsMagick" arch="s390x">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="02af8ccf25b1a3588dcac8769767baa3e6c6a95ceb5f0d5def0ec0497b155826" name="GraphicsMagick" arch="src">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="ff9cbde932b780a4d1a5f5e4b4d9b15567cac3ad484663a3f4e6f5b251c4eaf2" name="GraphicsMagick" arch="x86_64">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="3bff7c160706d026144ee42e2a306ebe9f60ef54c388ddceb791c648ca845d8e" name="GraphicsMagick-devel" arch="aarch64">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="73cab147a111006b7619c6c33f6619ea5de1a94fcc602d2bd948ec4450f47d37" name="GraphicsMagick-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="b84d278989a5db9bff9f8041e81a7823fff0b2d8757c901fad480bd2e32fef04" name="GraphicsMagick-devel" arch="s390x">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="b91cb03d6ccd67cc9c0a9902596c40ae6286fa58f8f27d85af98937e8a847097" name="GraphicsMagick-devel" arch="x86_64">
  <version epoch="0" ver="1.3.35" rel="150300.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1516795200">- update to 1.3.28:
  * Security Fixes:
    BMP: Fix non-terminal loop due to unexpected bit-field mask
    value (DOS opportunity).
    PALM: Fix heap buffer underflow in builds with QuantumDepth=8.
    SetNexus() Fix heap overwrite under certain conditions due to
    using a wrong destination buffer. This issue impacts all
    1.3.X releases.
    TIFF: Fix heap buffer read overflow in LocaleNCompare() when
    parsing NEWS profile.
  * Bug fixes:
    DescribeImage(): Eliminate possible use of null pointer.
    GIF: Fix memory leak of global colormap in error path.
    GZ: Writing to gzip files with the extension ".gz" was
    not working with Zlib 1.2.8.
    JNG: Fix buffer read overflow (a tiny fixed overflow of just
    one byte).
    JPEG: Promoting certain libjpeg warnings to errors caused
    much more problems than expected. The promotion of
    warnings to errors is removed. Claimed pixel dimensions
    are validated by file size before allocating memory for
    the pixels.
    IntegralRotateImage(): Assure that reported error in rotate by
    270 case does immediately terminate processing.
    MNG: Fix possible null pointer reference related to DEFI chunk
    parsing. Fix minor heap read overflow (constrained to just
    one byte) due to an ordering issue in a limit check. Fix
    memory leaks in error path.
    WebP: Fix stack buffer overflow in WriteWEBPImage() which
    occurs with libwebp 0.5.0 or newer due to a structure type
    change in the structure passed to the progress monitor
    callback.
    WPG: Memory leaks fixed.
  * API Updates:
    InterpolateViewColor(): This function now returns MagickPassFail
    (an unsigned int) rather than void so that errors can be
    efficiently reported.
    The magick/pixel_cache.h header is updated to add deprecation
    attributes such that code using GetPixels(), GetIndexes(),
    and GetOnePixel() will produce deprecation warnings for
    compilers which support them. These functions will not be
    removed in the 1.3.X release series and when they are
    removed, pre-processor macros will be added so a replacement
    function is used instead. There is a long-term objective to
    eliminate functionally-redundant pixel cache functions to
    only the ones with the best properties since this reduces
    maintenance and may reduce the depth of the call stack
    (improving performance).
  * removed unneded GraphicsMagick-release-date-missing-quote.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1519128000">- Add explicit buildrequires on: pkgconfig(libwebpmux),
  pkgconfig(libpng), pkgconfig(x11), pkgconfig(xext),
  pkgconfig(zlib), libjpeg-devel. all
  of them direct build dependencies but not included in
  the spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1527076800">- update to 1.3.29:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project
    . JNG: Require that the embedded JPEG image have the same dimensions
    as the JNG image as provided by JHDR. Avoids a heap write overflow.
    . MNG: Arbitrarily limit the number of loops which may be requested by
    the MNG LOOP chunk to 512 loops, and provide the '-define
    mng:maximum-loops=value' option in case the user wants to change the
    limit.  This fixes a denial of service caused by large LOOP
    specifications.
  * Bug fixes:
    . DICOM: Pre/post rescale functions are temporarily disabled (until
    the implementation is fixed).
    . JPEG: Fix regression in last release in which reading some JPEG
    files produces the error "Improper call to JPEG library in state
    201".
    . ICON: Some DIB-based Windows ICON files were reported as corrupt to
    an unexpectedly missing opacity mask image.
    . In-memory Blob I/O: Don't implicitly increase the allocation size
    due to seek offsets.
    . MNG: Detect and handle failure to allocate global PLTE. Fix divide
    by zero.
    . DrawGetStrokeDashArray(): Check for failure to allocate memory.
    . BlobToImage(): Now produces useful exception reports to cover the
    cases where 'magick' was not set and the file format could not be
    deduced from its header.
  * API Updates:
    . Wand API: Added MagickIsPaletteImage(), MagickIsOpaqueImage(),
    MagickIsMonochromeImage(), MagickIsGrayImage(), MagickHasColormap()
    based on contributions by Troy Patteson.
    . New structure ImageExtra added and Image 'clip_mask' member is
    replaced by 'extra' which points to private ImageExtra allocation.
    The ImageGetClipMask() function now provides access to the clip mask
    image.
    . New structure DrawInfoExtra and DrawInfo 'clip_path' is replaced by
    'extra' which points to private DrawInfoExtra allocation.  The
    DrawInfoGetClipPath() function now provides access to the clip path.
    . New core library functions: GetImageCompositeMask(),
    CompositeMaskImage(), CompositePathImage(), SetImageCompositeMask(),
    ImageGetClipMask(), ImageGetCompositeMask(), DrawInfoGetClipPath(),
    DrawInfoGetCompositePath()
    . Deprecated core library functions: RegisterStaticModules(),
    UnregisterStaticModules().
  * Feature improvements:
    . Static modules (in static library or shared library without
    dynamically loadable modules) are now lazy-loaded using the same
    external interface as the lazy-loader for dynamic modules.  This
    results in more similarity between the builds and reduces the fixed
    initialization overhead by only initializing the modules which are
    used.
    . SVG: The quality of SVG support has been significantly improved due
    to the efforts of Greg Wolfe.
    . FreeType/TTF rendering: Rendering fixes for opacity.</changelog>
  <changelog author="idonmez@suse.com" date="1533297600">- update to 1.3.30:
  * Security Fixes:
    . GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 238 issues have been opened by oss-fuzz and 230 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
    . SVG/Rendering: Fix heap write overflow of PrimitiveInfo and
    PointInfo arrays.  This is another manefestation of CVE-2016-2317,
    which should finally be fixed correctly due to active
    detection/correction of pending overflow rather than using
    estimation.
  * Bug fixes:
    . Many oss-fuzz fixes are bug fixes.
    . Drawing/Rendering: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . MIFF: Detect end of file while reading image directory.
    . SVG: Many more fixes by Gregory J Wolfe (see the ChangeLog).
    . The AlphaCompositePixel macro was producing wrong results when the
    output alpha value was not 100% opaque. This is a regression
    introduced in 1.3.29.
    . TILE: Fix problem with tiling JPEG images because the size request
    used by the TILE algorithm was also causing re-scaling in the JPEG
    reader.  The problem is solved by stripping the size request before
    reading the image.
  * API Updates:
    . The size of PrimitiveInfo (believed to be an internal/private
    structure but in a header which is installed, has been increased to
    store a 'flags' argument. This is intended to be an internal
    interface but but may be detected as an ABI change.
  * Behavior Changes:
    . JPEG: The JPEG reader now allows 3 warnings of any particular type
    before giving up on reading and throwing an exception.  This choice
    was made after observing files which produce hundreds of warnings
    and consume massive amounts of memory before reading the image data
    has even started.  It is currently unknown how many files which were
    previously accepted will be rejected by default.  The number of
    allowed warnings may be adjusted using '-define
    jpeg:max-warnings=&lt;value&gt;'.  The default limit will be adjusted
    based on reported user experiences and may be adjusted prior to
    compilation via the MaxWarningCount definition in coders/jpeg.c.</changelog>
  <changelog author="pgajdos@suse.com" date="1534939200">- disable PS, PS2, PS3 and PDF coders by default, remove gs calls
  from delegates.mgk [bsc#1105592]
  + GraphicsMagick-disable-insecure-coders.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1545220800">- update to 1.3.31:
  Special Issues:
  * Firmware and operating system updates to address the Spectre
    vulnerability (and possibly to some extent the Meltdown
    vulnerability) have substantially penalized GraphicsMagick's OpenMP
    performance.  Performance is reduced even with GCC 7 and 8's
    improved optimizers. There does not appear to be anything we can do
    about this.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor.
  Bug fixes:
  * See above note about oss-fuzz fixes.
  * CINEON: Fix unexpected hang on a crafted Cineon image.  SourceForge
    issue 571.
  * Drawing recursion is limited to 100 and may be tuned via the
    MAX_DRAWIMAGE_RECURSION pre-processor definition.
  * Fix reading MIFF files using legacy keyword 'color-profile' for ICC
    color profile as was used by ImageMagick 4.2.9.
  * Fix reading/writing files when 'magick' is specified in lower case.
    This bug was a regression in 1.3.30.
  New Features:
  * TIFF: Support Zstd compression in TIFF.  This requires libtiff
    4.0.10 or later.
  * TIFF: Support WebP compression in TIFF.  This requires libtiff
    4.0.10 or later.
  API Updates:
  * MagickMonitor() is marked as deprecated.
- see NEWS.txt for more details</changelog>
  <changelog author="pgajdos@suse.com" date="1545220801">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- version update to 1.3.32
  New Features:
  * Added support for writing the Braille image format (by Samuel
    Thibault).
  * WebP writer: Support WebP 'use_sharp_yuv' option ("if needed, use
    sharp (and slow) RGB-&gt;YUV conversion") via `-define
    webp:use-sharp-yuv=true`.
  * The version command output now reports the OpenMP specification
    number rather than just the integer version identifier.
  API Updates:
  * ReallocateImageColormap() added to re-allocate an existing colormap.
  * Some improperly-exposed globals are now static as they should have
    been.
  * The 'benchmark' command now shows 6 digits (microseconds) of elapsed
    time indication.
  * The 'time' command now shows 6 digits (microseconds) of elapsed time
    indication.
  * The logging facility now shows 6 digits (microseconds) of time
    resolulution
  * Dcraw: When QuantumDepth is greater than 8, pass -6 option to dcraw
    so that it returns a 16-bit/sample image.
  * Dcraw: If Dcraw supports TIFF format, then request TIFF format in
    order to be able to acquire more metatdata.
  * Scale algorithm: Eliminate artifacts when scaling an image with
    semi-transparent pixels.
  * Library metrics: The number of shared library relocations and the
    amount of initialized data has been signficantly reduced by
    following recommendations from Ulrich Drepper's document `How To
    Write Shared Libraries &lt;https://akkadia.org/drepper/dsohowto.pdf&gt;`_.
  (Security) Bug Fixes:
  * see NEWS.txt
  * fixes [bsc#1138425]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1563192000">- Cleanup BuildRequires:
  * Remove ghostscript-library (support removed  upstream)
  * Use ghostscript-mini (sufficient for path and feature detection)
    instead of full ghostscript (implicitly added by ghostscript-library)
  * Remove ghostscript-fonts-other (unused).</changelog>
  <changelog author="pgajdos@suse.com" date="1566388800">- drop JPEG2000 support [bsc#1144240]</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- version update to 1.3.33
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize is often longer than the
    time to read the input file, process the image, and write the output
    file.  If the 'ICU' dependency can not be avoided, then make sure to
    use the modules build.  Please lobby the 'ICU' library developers to
    change their implementation to avoid long start-up times due to
    merely linking with the library.
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 353 issues have been opened by oss-fuzz and 338 of those
    issues have been resolved.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  * Documentation has been added regarding security hazards due to
    commands which support a '@filename' syntax.
  * MontageImages(): Fix wrong length argument to strlcat() when
    building montage directory, which could allow heap overwrite.
  * PNG: Pass correct size value to strlcat() in module registration
    code.  This bug is noticed to cause problems for Apple's OS X and
    Linux Alpine with musl libc.  This fixes a regression introduced by
    the 1.3.32 release.
  * Re-implement command-line utility `'@'` file inclusion support for
    `-comment`, `-draw`, `-format`, and `-label` which was removed for
    the 1.3.32 release.  The new implementation is isolated to
    command-line utility implementation code rather than being deeply
    embedded in the library and exposed in other usage contexts.  This
    fixes a regression introduced by the 1.3.32 release.
  * CAPTION: The The CAPTION reader did not appear to work at all any
    more.  Now it works again, but still not very well.
  * MagickXDisplayImage(): Fix heap overwrite of windows-&gt;image.name and
    windows-&gt;image.icon_name buffers.  This bug has surely existed since
    early GraphicsMagick releases.
  * MagickXAnimateImages(): Fix memory leak of scene_info.pixels.
  * AcquireTemporaryFileDescriptor(): Fix compilation under Cygwin. This
    fixes a regression introduced by the 1.3.32 release.
  * PNG: Fix saving to palette when mage has an alpha channel but no
    color is marked as transparent.
  * Compilation warnings in the Visual Studio WIN64 build due to the
    'long' type being only 32-bits have been addressed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- security update
- added patches
  fix CVE-2022-1270 [bsc#1198351], Heap buffer overflow when parsing MIFF
  + GraphicsMagick-CVE-2022-1270.patch</changelog>
</package>
<package pkgid="c0ba5c3da13cef22816aa3728c2f16fbe64dc2f79f3f8ae1ab9236b6003fe52b" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.2" rel="150000.3.3.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
</package>
<package pkgid="d95bc1059b45b349f4947d208cf50e4b6e7504ea9904c6564e011f5dfc17af73" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.2" rel="150000.3.3.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
</package>
<package pkgid="bb741d40b2cb561f99f1938ffa8153f3ffa43429565ef799907c64b9ff058ef3" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.2" rel="150000.3.3.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
</package>
<package pkgid="e51c7744faf8fbd69fb5790dad14c5d178697022c2f47fecfe6f1988871b8790" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="66001f7eb6e3176cdeed698827b4151493d28612e6353e902ea98ce60a44ef2d" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="72abce455ae9f9dd3c2da3006a88a4bcc7c9132d438e8873fa11172ae24a2cb9" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="b04145b290c7420c47eeb1276f1d10226cd3bbad26f1dad3376890bf5e892c95" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="99f5c36a90ea7d6a5cc2f757c91ad406def3b31be4a5d960f12506f3de443e47" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="4d39b2218fc9dfaf22db3823f244777e48a9498989518a5c97aaed05cfad2ab4" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="6ba4a7ddec21ff3836e14e6a6726725d30e1c8ad7d09d5eabffef38b6931015f" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="83c8df19a042472e5f48c35fdc777b80e97064c58ba658537e80583f4dc59d58" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="f0cbf7f8a47733f80879d011c1d3d534d0d954bd831b3e8f99ecec54d6ca0cc4" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="1dedcdf22825f7b19e2a60e0047f8aebbd70cc0b8178aa73e805728280d43234" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="76ce95790eec2e3883da5962fffeeb6424744728af38fa9bdd8361539568d1f7" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="77dc67cf3707e4e506106ffea65a96bfa6358fd0de50ac3539aea44459f81b3b" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="b775c84e8dc746b8d66d9b129b7877d93790f0fcc6e46efb24064a962dbc2767" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="3cb227221f04a3ec8499a8231d04d8a59c82e47152e6e023a6b4d81b166d5a51" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="46934e5473d0141038b8a62c63aa2a0520cb5659b3326534a75820fc813ea1e5" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="962f235d026ed1d12eaf4d35343a437519b4f61ae0cab0f879641f513ce9be5b" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="5d11a351d167de79a4131e9b86e00ee81dde5e5686189350c0e2814b90f8fb49" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="c1d34f057ff63faffb6ca7f0507585e70abaece40b9ba1991ffe6167e537dbee" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="faaa10d98e0828065c42784ea47e72877a4fb7eb7a0b92a2766c3b93a5e64a41" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="369396320588e50fd178e440f12fa292a990eeed7e734da575545531a7b44ef4" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="d3d49ac52451d500da30b95997ca246310c9eb2507d8d7f813c1f367f4dc99a4" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="c641ac88bc8311d35ba320fbca585f43b4b5ca661d0046cd14a20f8d00cb9d52" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="49efdd73ba52475670a99980913fe9985fe378ca4dff877fd896018a1376bc77" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="d23ce37c5ce6c97af098d14e2bf3f457a146042fd90d22c0e77821b9115e2c74" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="5c55d3c59ad0c8b07ebcc21ccaee011faff4d8c58be190a04393a64e334aa0fc" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="4f0f387693a3f55b223ea179687acfc483651cd6005835ae18587f4b65b0e86f" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="98b3b7dfa7a3ddc417197de60e34593db93a68541b4df59af29121933b572add" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="fca628543b46e06993abb5d1c8cf3caadbedafa731e16ce26bcf23e8e6748b79" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="39000cd7611f7c71c703d8397ea636a34a995bb9c214ef7f5c453e35ffa2247f" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="485d67f85c118408fc60bb2ca434ccca656990a22b978865b79e212f4d704b24" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="abec1420d9c036806f8aaae7055d5000bd132b490bfcdaccead5eb09ecc45bf0" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="10429c4fe0e54bcb0578d38fb4d91c97187c3a739ba1dab4470d1137623d0dd8" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="b88e9725f0275af9f0648a9262a7df14b47f70efa6d86bd01dd1af3cfa0c3fd4" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="d5b9fd8030de6f9e2b895d4e0442a6b5d5044eb287d066303d832f1e1b567c35" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="053ff68f770dc69ac2b6f687262ce19e6f70d0aefedbea21d1335c6b097b5607" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="428e34772ede0f40e61d34599f80f3ec066da95dc674c34b8d3f3d4a9051185a" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="a3c2715fbd0fb5b9ed5fdbf10343677825042b46be77fa6c63d9e4cc93074d34" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="da341e72fa30c8e18171f15d5d08b170bcbe07ffacb4ca6d85b6683658484efc" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="ee7e634e5eda9119ac4dd43b914b62f75680b0c1a9060d8f356f1c66b621fa37" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="df19070415a42adc0d92bd91a310e74ba96b0b82873bb3be4fad181b8586a47f" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="591ce4f011614bd737733264653572d086cbbbe735380b9f0256a11db3202a45" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="44f95f28f0753e8b2080bb84c56eabf0fbb99c95079624a850c3da6b9a15e308" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="98eedcf88ce3daba0f93ba01f38ddee143747fa185ee1d6623a3ee8cfc0e6467" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="b17fcc3ac88809e4b753eaa8e458d8b55ebee2f65455510c02a76ab0e8580ce0" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="eac494e7748a0ba86b20f8f00c9215d27d1e78d37b04e0319511c501c20f9a58" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="1f591ceeec865dcdcd670fc5ade3dd8185a6f84f98ba6a29e6ce4b762da166bc" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="0b570e1078a9a09a81bbf9102d51cc120478ebfbec40f6c2005e9189ab218fd0" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="80f1eacb47fd348bba0af9632b84ab43419595e1eb29eb315b1a4adb2e6880be" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="db8966da03d3639ad964ff0787de4444e9e9b18446c5982995aa0bc07ac5dce8" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="4fdff4c5708a1f117551143a2626445112e0e171b9ade5c9d01078e578ba14a7" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="b146bb63267df1d6fd9214f049d6235fececf3ff9cfcddbb86dfaed854c9434c" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="da52df555d95339229cf3889f8a2045e69de1b1712d17e660648c7d1f8c09e9d" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="01534c67198745d4928f797be0c44462ef5128cda312edaabd6dd23568502797" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="28c29998dd2c34bfade1804c958ec2c3629ccb413d67924ac94a477e119e7578" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="64537db1040b92fd4a75465d93c47a963a94ad0eb8fcad95a284e01f6c5d5feb" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="9796f7c26f62b2895bad16e097796b28806ef8f42c14b693d5862cef7b9181ee" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="b3f138c5ccb7636a35149fe601c0499904853f80a75affdc154d44bbd628f6db" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="2dea93fdd7ad03dc9e48fbee6da812a9917a9d33c940cdb9b005aec5f1346ea5" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="29287e3d49feddae311b8ea2acad6abdfc19453598377111d6b5c459eb0c105e" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="439b9be74bb2511437183743946c76948b4ffe69f8bbf13e5200b0fa15695df4" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="8eecf89a6e7460b3d278ba88b5bc729765bec75a1419ee796b0ab1ab771c3a9c" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="6f110f7ec62776eddc0b775e8b376b5ab5e9f502e50f1127530e168fb074268a" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="07b3f8d66d82888f9acf4cd30b10dc32f141687966a402668622d97fe5ce6bfe" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="47b7497f59ec07793179560002dc3579a535cb95e9a80e88f42f42ed4d49a639" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="8a1c2af21fd98b1f3b638689a031c10befc83ca365f133462dbf7500911e6b97" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="7b166125d2efea0d2cff5555bff8b4c7c4b09ebc2738d3fa60f893b04696ffc0" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="90a0bc60d067a154ae30c4087dee200d9a75f4a4be1ea6d2a785419844f1676c" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="26bf1590e041782a1019955be34ef133c301613222955fec933ae67d19c121b6" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="343f6a6b88f6cd407daab8e4f7d1268cb22b0437f993f219b3c8fa33a1bb873f" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="174498ad7a50699eef65f5a1754b347f35c31ecc2ae813e0f66b64fa05276e5e" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="04c9f2dd5fa2b752faba6bcfd9bd85e5b69740123adffa0d6d394e56676deb26" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="c1cd63aa7bb8ac0025e6bfb1dda25b720e1ff3aa6bc741923b4b9cf653487a09" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="f3131a19afac7878a915e0c10234d462a1bffddcf148add6155fd5e4504a89a9" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="2e23d783c31508a4d2572deda5a6e8f3fdeeb4de9f55f380004f8587e2630dd0" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="d6ce4ae39462d9557932fc27e34e8fc30c70212f99d69b6028f335402b18c22f" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="b7006e8df09e0e56cb8118cb42c08130b66fa33f6110b780750bf42acf8be58a" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="ffe9db0eee3f725468e47f93c4ad80e8a453e5ae0c407ab244fe545dfb35820b" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="8c48a611fbc7dc67d98172a9d9e2449f07ae441b8fd0bbcbf00a8731c4da2c07" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="3c9c9156945813846881b48612e4c58f4fd67f7b9eb2cba02c25743c1df03216" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="cfa85576895bb993e4ccb85527773d77dcea54e7f6e6753b2cb4815f1e33bb4c" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="d78f1fecfc0372d4953045b8e2d42f71db693e0efa8055231a482dba264872cb" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="d9ab73bb4183f24a0a93876c0915ab2e18ab608f73b9c92ebf123e14740ac261" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="2c4f37f8f2ec58cdf6df23ca5463e99cbd29c872d8e96edd93c13638a6160335" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="463082bfae381d32ecabeaf8f6e47262ab5fac2b6c65a378cd9e6507a8239d2d" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="627508ea617b2b10f42e39378109df639bb74257ccbcaa0dbb0faa9e871ad47e" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="09cda9bc77df1a5e71b7a9185f79776a7a089fcdc943bc1d7e5c17e191d95cd8" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="0499b9ff89d5317c2916e0ac43e0b31e6b0b8a9d6eab6ee94ab3cfe13c097542" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="f92db4f9d84163b582bac61cfef890aa30a4b5abff1da29d250a8cd13500e0d9" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="9bdd7bd2c96fe0f78fe3c49352589bf7bfa92e0512bc23d02ec416ab740cb779" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="33c540f0474b48ffe7a9c5eeb5c7e45429adb1c601578f44f86d1bcb13438d6a" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="db6953ccaa8afd72e4536d181c0df7e639e25fc3faf3a0ddc994349574990949" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="c0409a01069f254d126a2860e052259e516ffce5f4873f9c30e00a8026f595e4" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="9cc48b87da451a292857a168d0547a891c25810e196eed0fa6ba1f4b72bbdf99" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="4a0c553c71b0d49e661ab4e7d3f8e97a9868e87e283385075388eefd6c6960cb" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="bf1e3980df320e5dfac57e0c66516821412a170b0438055e8ff9273379231879" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="e01eeb585ac92fd7c8260094881305c9202f17d60b4f321858f81de4f3c78860" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="778fdfecd5a5e1f36aef81b45c24911aa5e965b74b8a8df85b30bbf0fa8c39b7" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="d86a19f5c6b4acc73326a3eda3f6c881fa7376470bd3ddd104ac323e50157541" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="dfebfa1a436149d42ebdc71bd79edca64b82a578fb63649251ae21c370031a48" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="44c568c48051c50cff7cec0a49c58212d9029152ebf298d84adc5968f3cec3ce" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="b356e93f95b183069712fb4f6076b4b36343b465e78b1ad73966102fd7110646" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="666e4392051cfed7d5049c160759a840021d1f1c6a5af778095bd45174f267a9" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="51f4305e9deeb28c7b0f93568e49104edbf79a058fc786b057e0d41a4e649bb1" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="a33f777e40a647dde875de36729e10df38273b8fd2dc75d281df65dabefd628e" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="8851aefd2211a25f1282ddf83902f414e1fc2024ac0d3f857801352b567c6500" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="fbdb9a8ad063b17dcff564b07395be3f0e544271bc483d533f20249b34eba33f" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="a3af26f717c5db9d5015b61a475aa0a96f938789cf06dad21bd97475e8533cd8" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="6f6b6f61baffa2ded4dbc2be4e8de85a30ad72a2e0444be6b4d769006d30c86a" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="9d6c7c4cd5f3ab75a2f1b232f8509cd11287f877a34c52b08fd141cc168759f1" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="2a5bda05f0d232ad82854a48de3d9b25889f1d84d3b81664f9409c513794d000" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="4bc2a03a447ca578c0ec84c05551e7793ab11b8cfd8f70d03a840b4a5c79513b" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="b111662def61781d6114f7b03d0744807f28778ef49be22022453335119b7782" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="ada5a5bd31575977fca55391668fde946fceee5b607d4711f4f3c74c129df083" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="79430b569337be10770d806461126f67ab1f0ec3123eb24737fb7458c83e780b" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="fc1abede54f522e99f59f197986fe72f643bb276549bbeffece212edd5bab9a5" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="8e1a80e1ce1e21180df71b7cdf1a66b73b63ef76bf95169dfe8b422a88e04f46" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="0be1e27b0b7f5b49070b61a48f19709087f1762eaf9264c43b3568185c1f853f" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="9c15c0a794f20ae44be8f3408f6f8dd2ed92810439c4f90e9479dfda622977d3" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.18.1"/>
  <changelog author="pgajdos@suse.com" date="1559044800">- disable also PCL [bsc#1136183]
- modified patches
  % ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
</package>
<package pkgid="cdccaf941fcac2cb8190f630f1becfecbd556ec7d40dcceeefb71156b131b2b8" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="66f1cf4297726a571b34891b6382479c4d57243494aa2e11b596b933ec3563fa" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="95b82614bb897165e2c759c201b1c66709859a45ce1df642c32c8fd57c1efb4f" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="86723843a95ca411ab59a261d7101759de89d7ed10a28e34b36d8ea0b81cc9b7" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="b38377cd3d914841c187674c90b68cbf328b4f9741b89b81fc889cc197c46289" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="6d47a2a96678b932e505aeea9729a8e1c26284c1dbeb2dc07a188c4cc312dc6f" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="87664274b35b5ff57e99dc2e57e9147d84f572e5fcf3a2af89796d36451fa5c1" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="5140089799ad85a04e47677e957c235371a65013385ea36672b181aee35c3bdf" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.26.1"/>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
</package>
<package pkgid="7f28774cee83b395cc7442b5faad09c92bc1b4247277c3e8ab01a4fb1cae1b15" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="89ad566ff69c76df83d20ea5cd3fada6e84719bc4f2428122a46639aa69822f4" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="ec5868a5c96d20a6b7fc8a901c901e6925f8f6a755a46c2ecc8c362a170bf09c" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="0f5f793d052deb3f349418a72cd9b8bf38c594c46d1a98b0c9a0b962a5edbd69" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.31.1"/>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
</package>
<package pkgid="271e2bbb794f2e97b6f02bf1abf75a2444e3028dcea07c4added28a9b0f45bb7" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="2c04384e9ca9771bd3a8dad1ffc6b733862d1fc9596737ad997dede8d1982e39" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="43c5450cf67c743dddb4d0dc714b5cdeedc6386e999fff281ab2706fdc3a3c94" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="7b59e019430ddf6c05fa1c06dae31f37f9dfa1876a3cb7ceb1b42273b42d1734" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.36.1"/>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
</package>
<package pkgid="1d946dbee73019fd20b5e9023aaa594d7b02179d812242dc3ce097315e886cda" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="c15eef0d335b2953c41b8fdbbe3099b51d968a31359bcf34e2159d6b8a3d0323" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="55922e6f8e20ccdd79de5efe2d951b9f3b986da7fa1cdc6ecc6a586621687faa" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="201ad1e20ce5afac1bb9dfef26c9acb8e4c6018c9c90610f1a62ad82c510603c" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="150200.10.39.1"/>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184000">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1652184001">- added patches
  use png_get_eXIf_1 when available [bsc#1197147]
  + ImageMagick-missing-png_get_eXIf_1.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655294400">- security update
- added patches
  fix CVE-2019-17540 [bsc#1153866], heap-based buffer overflow in ReadPSInfo in coders/ps.c
  + ImageMagick-CVE-2019-17540.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661774400">- security update
- added patches
  fix CVE-2021-20224 [bsc#1202800], integer overflow in ExportIndexQuantum() function in MagickCore/quantum-export.c
  + ImageMagick-CVE-2021-20224.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2021-3574 [bsc#1203212], memory leaks with convert command
  + ImageMagick-CVE-2021-3574.patch</changelog>
</package>
<package pkgid="ad460a1012e98cabc9c450033ad238b79559fcdd6760ccb04e9a56fb6bcfb617" name="LibVNCServer" arch="src">
  <version epoch="0" ver="0.9.10" rel="150000.4.29.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1357041600">- Switch SSL backend to openssl, we all agree that OpenSSL
  has it faults, but it is heavily optimized in all platforms
  not only x86 and performance matters in interactive,latency
  sensitive tasks like VNC.
- libvncserver-ossl.patch Ensures openssl use less memory
  and avoid abi breaks on openSSL updates.</changelog>
  <changelog author="jengelh@inai.de" date="1357992000">- Follow shared library packaging guidelines
- Avoid self-obsolete tag
- Put libvncserver-config into -devel where it should belong
- Provide pkgconfig() RPM symbols</changelog>
  <changelog author="mmeister@suse.com" date="1363608000">- Add Url to Source section in spec file</changelog>
  <changelog author="coolo@suse.com" date="1404216000">- remove old .bz2 file</changelog>
  <changelog author="olaf@aepfle.de" date="1412337600">- Obsolete old LibVNCServer.rpm in libvncclient0 package. The old
  version included binaries, devel and runtime libs. But nothing
  removes the old package, which leads to file conflicts during
  upgrade if linuxvnc.rpm is not on the install media (bnc#893343)</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 0.9.10
  + Moved the whole project from sourceforge to https://libvnc.github.io/.
  + Cleaned out the autotools build system which now uses autoreconf.
  + Updated noVNC HTML5 client to latest version.
  + Split out x11vnc sources into separate repository at
    https://github.com/LibVNC/x11vnc
  + Split out vncterm sources into separate repository at
    https://github.com/LibVNC/vncterm
  + Split out VisualNaCro sources into separate repository at
    https://github.com/LibVNC/VisualNaCro
  + Merged Debian patches.
  + Fixed some security-related buffer overflow cases.
  + Added compatibility headers to make LibVNCServer/LibVNCClient
    build on native Windows 8.
  + Update LZO to version 2.07, fixing CVE-2014-4607.
  + Merged patches from KDE/krfb.
  + Can now do IPv6 without IPv4.
  + Fixed a use-after-free issue in scale.c.
- Update Url and download source to new project home
- Remove LibVNCServer-0.9.9-no_x11vnc.patch; upstream splited it
  out of main tarball
- Rebase libvncserver-ossl.patch to upstream changes
  &gt; libvncserver-0.9.10-ossl.patch
- Remove linuxvnc subpackage; like x11vnc, it has been splited out
  but is depreciated and unmaintained.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396800">- libvncserver-0.9.10-ossl.patch: Update, do not
  RAND_load_file("/dev/urandom", 1024) if the the PRNG is already
  seeded. (It always is on linux)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396801">- Remove xorg-x11-devel from buildRequires, X libraries
  are not directly used/linked</changelog>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch
  * CVE-2018-20750 [bsc#1123832]
    + LibVNCServer-CVE-2018-20750.patch
  * CVE-2018-20748 [bsc#1123823]
    + LibVNCServer-CVE-2018-20748.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch
- note the correct way how to run the testsuite, it does not
  seem to be usable as it is, though (segfaults)</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- security update
- added patches
  fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
  + LibVNCServer-CVE-2017-18922.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594209600">- security update
- added patches
  fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
  + LibVNCServer-CVE-2020-14397.patch
  fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  + LibVNCServer-CVE-2020-14399.patch
  fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  + LibVNCServer-CVE-2020-14400.patch
  fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
  + LibVNCServer-CVE-2020-14401.patch
  fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
  + LibVNCServer-CVE-2020-14402,14403,14404.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- security update
- added patches
  fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
  + LibVNCServer-CVE-2018-21247.patch
  fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
  + LibVNCServer-CVE-2019-20839.patch
  fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
  + LibVNCServer-CVE-2019-20840.patch
  fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  + LibVNCServer-CVE-2020-14398.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS
  + LibVNCServer-CVE-2020-25708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
</package>
<package pkgid="8a04c611cfbabfcf7c461908a56a845c3e1e37a84d77c484f61fc0267c18899c" name="LibVNCServer-devel" arch="aarch64">
  <version epoch="0" ver="0.9.10" rel="150000.4.29.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 0.9.10
  + Moved the whole project from sourceforge to https://libvnc.github.io/.
  + Cleaned out the autotools build system which now uses autoreconf.
  + Updated noVNC HTML5 client to latest version.
  + Split out x11vnc sources into separate repository at
    https://github.com/LibVNC/x11vnc
  + Split out vncterm sources into separate repository at
    https://github.com/LibVNC/vncterm
  + Split out VisualNaCro sources into separate repository at
    https://github.com/LibVNC/VisualNaCro
  + Merged Debian patches.
  + Fixed some security-related buffer overflow cases.
  + Added compatibility headers to make LibVNCServer/LibVNCClient
    build on native Windows 8.
  + Update LZO to version 2.07, fixing CVE-2014-4607.
  + Merged patches from KDE/krfb.
  + Can now do IPv6 without IPv4.
  + Fixed a use-after-free issue in scale.c.
- Update Url and download source to new project home
- Remove LibVNCServer-0.9.9-no_x11vnc.patch; upstream splited it
  out of main tarball
- Rebase libvncserver-ossl.patch to upstream changes
  &gt; libvncserver-0.9.10-ossl.patch
- Remove linuxvnc subpackage; like x11vnc, it has been splited out
  but is depreciated and unmaintained.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396800">- libvncserver-0.9.10-ossl.patch: Update, do not
  RAND_load_file("/dev/urandom", 1024) if the the PRNG is already
  seeded. (It always is on linux)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396801">- Remove xorg-x11-devel from buildRequires, X libraries
  are not directly used/linked</changelog>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch
  * CVE-2018-20750 [bsc#1123832]
    + LibVNCServer-CVE-2018-20750.patch
  * CVE-2018-20748 [bsc#1123823]
    + LibVNCServer-CVE-2018-20748.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch
- note the correct way how to run the testsuite, it does not
  seem to be usable as it is, though (segfaults)</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- security update
- added patches
  fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
  + LibVNCServer-CVE-2017-18922.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594209600">- security update
- added patches
  fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
  + LibVNCServer-CVE-2020-14397.patch
  fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  + LibVNCServer-CVE-2020-14399.patch
  fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  + LibVNCServer-CVE-2020-14400.patch
  fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
  + LibVNCServer-CVE-2020-14401.patch
  fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
  + LibVNCServer-CVE-2020-14402,14403,14404.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- security update
- added patches
  fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
  + LibVNCServer-CVE-2018-21247.patch
  fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
  + LibVNCServer-CVE-2019-20839.patch
  fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
  + LibVNCServer-CVE-2019-20840.patch
  fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  + LibVNCServer-CVE-2020-14398.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS
  + LibVNCServer-CVE-2020-25708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
</package>
<package pkgid="d2ab75621439715c93d3c42a70e6312ad33013ae0234e480e8692e0d37cb0df2" name="LibVNCServer-devel" arch="ppc64le">
  <version epoch="0" ver="0.9.10" rel="150000.4.29.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 0.9.10
  + Moved the whole project from sourceforge to https://libvnc.github.io/.
  + Cleaned out the autotools build system which now uses autoreconf.
  + Updated noVNC HTML5 client to latest version.
  + Split out x11vnc sources into separate repository at
    https://github.com/LibVNC/x11vnc
  + Split out vncterm sources into separate repository at
    https://github.com/LibVNC/vncterm
  + Split out VisualNaCro sources into separate repository at
    https://github.com/LibVNC/VisualNaCro
  + Merged Debian patches.
  + Fixed some security-related buffer overflow cases.
  + Added compatibility headers to make LibVNCServer/LibVNCClient
    build on native Windows 8.
  + Update LZO to version 2.07, fixing CVE-2014-4607.
  + Merged patches from KDE/krfb.
  + Can now do IPv6 without IPv4.
  + Fixed a use-after-free issue in scale.c.
- Update Url and download source to new project home
- Remove LibVNCServer-0.9.9-no_x11vnc.patch; upstream splited it
  out of main tarball
- Rebase libvncserver-ossl.patch to upstream changes
  &gt; libvncserver-0.9.10-ossl.patch
- Remove linuxvnc subpackage; like x11vnc, it has been splited out
  but is depreciated and unmaintained.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396800">- libvncserver-0.9.10-ossl.patch: Update, do not
  RAND_load_file("/dev/urandom", 1024) if the the PRNG is already
  seeded. (It always is on linux)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396801">- Remove xorg-x11-devel from buildRequires, X libraries
  are not directly used/linked</changelog>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch
  * CVE-2018-20750 [bsc#1123832]
    + LibVNCServer-CVE-2018-20750.patch
  * CVE-2018-20748 [bsc#1123823]
    + LibVNCServer-CVE-2018-20748.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch
- note the correct way how to run the testsuite, it does not
  seem to be usable as it is, though (segfaults)</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- security update
- added patches
  fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
  + LibVNCServer-CVE-2017-18922.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594209600">- security update
- added patches
  fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
  + LibVNCServer-CVE-2020-14397.patch
  fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  + LibVNCServer-CVE-2020-14399.patch
  fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  + LibVNCServer-CVE-2020-14400.patch
  fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
  + LibVNCServer-CVE-2020-14401.patch
  fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
  + LibVNCServer-CVE-2020-14402,14403,14404.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- security update
- added patches
  fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
  + LibVNCServer-CVE-2018-21247.patch
  fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
  + LibVNCServer-CVE-2019-20839.patch
  fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
  + LibVNCServer-CVE-2019-20840.patch
  fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  + LibVNCServer-CVE-2020-14398.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS
  + LibVNCServer-CVE-2020-25708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
</package>
<package pkgid="f40af4378627cd7b9f95214f2020eeff8e7b0c8922a0b8ee6ba143908bb3c8f1" name="LibVNCServer-devel" arch="s390x">
  <version epoch="0" ver="0.9.10" rel="150000.4.29.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 0.9.10
  + Moved the whole project from sourceforge to https://libvnc.github.io/.
  + Cleaned out the autotools build system which now uses autoreconf.
  + Updated noVNC HTML5 client to latest version.
  + Split out x11vnc sources into separate repository at
    https://github.com/LibVNC/x11vnc
  + Split out vncterm sources into separate repository at
    https://github.com/LibVNC/vncterm
  + Split out VisualNaCro sources into separate repository at
    https://github.com/LibVNC/VisualNaCro
  + Merged Debian patches.
  + Fixed some security-related buffer overflow cases.
  + Added compatibility headers to make LibVNCServer/LibVNCClient
    build on native Windows 8.
  + Update LZO to version 2.07, fixing CVE-2014-4607.
  + Merged patches from KDE/krfb.
  + Can now do IPv6 without IPv4.
  + Fixed a use-after-free issue in scale.c.
- Update Url and download source to new project home
- Remove LibVNCServer-0.9.9-no_x11vnc.patch; upstream splited it
  out of main tarball
- Rebase libvncserver-ossl.patch to upstream changes
  &gt; libvncserver-0.9.10-ossl.patch
- Remove linuxvnc subpackage; like x11vnc, it has been splited out
  but is depreciated and unmaintained.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396800">- libvncserver-0.9.10-ossl.patch: Update, do not
  RAND_load_file("/dev/urandom", 1024) if the the PRNG is already
  seeded. (It always is on linux)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396801">- Remove xorg-x11-devel from buildRequires, X libraries
  are not directly used/linked</changelog>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch
  * CVE-2018-20750 [bsc#1123832]
    + LibVNCServer-CVE-2018-20750.patch
  * CVE-2018-20748 [bsc#1123823]
    + LibVNCServer-CVE-2018-20748.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch
- note the correct way how to run the testsuite, it does not
  seem to be usable as it is, though (segfaults)</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- security update
- added patches
  fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
  + LibVNCServer-CVE-2017-18922.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594209600">- security update
- added patches
  fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
  + LibVNCServer-CVE-2020-14397.patch
  fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  + LibVNCServer-CVE-2020-14399.patch
  fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  + LibVNCServer-CVE-2020-14400.patch
  fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
  + LibVNCServer-CVE-2020-14401.patch
  fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
  + LibVNCServer-CVE-2020-14402,14403,14404.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- security update
- added patches
  fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
  + LibVNCServer-CVE-2018-21247.patch
  fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
  + LibVNCServer-CVE-2019-20839.patch
  fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
  + LibVNCServer-CVE-2019-20840.patch
  fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  + LibVNCServer-CVE-2020-14398.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS
  + LibVNCServer-CVE-2020-25708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
</package>
<package pkgid="67c1b113aca8a002e224358ee5f18ca4f3b2b62f4287f4a0021c213a75699cd6" name="LibVNCServer-devel" arch="x86_64">
  <version epoch="0" ver="0.9.10" rel="150000.4.29.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 0.9.10
  + Moved the whole project from sourceforge to https://libvnc.github.io/.
  + Cleaned out the autotools build system which now uses autoreconf.
  + Updated noVNC HTML5 client to latest version.
  + Split out x11vnc sources into separate repository at
    https://github.com/LibVNC/x11vnc
  + Split out vncterm sources into separate repository at
    https://github.com/LibVNC/vncterm
  + Split out VisualNaCro sources into separate repository at
    https://github.com/LibVNC/VisualNaCro
  + Merged Debian patches.
  + Fixed some security-related buffer overflow cases.
  + Added compatibility headers to make LibVNCServer/LibVNCClient
    build on native Windows 8.
  + Update LZO to version 2.07, fixing CVE-2014-4607.
  + Merged patches from KDE/krfb.
  + Can now do IPv6 without IPv4.
  + Fixed a use-after-free issue in scale.c.
- Update Url and download source to new project home
- Remove LibVNCServer-0.9.9-no_x11vnc.patch; upstream splited it
  out of main tarball
- Rebase libvncserver-ossl.patch to upstream changes
  &gt; libvncserver-0.9.10-ossl.patch
- Remove linuxvnc subpackage; like x11vnc, it has been splited out
  but is depreciated and unmaintained.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396800">- libvncserver-0.9.10-ossl.patch: Update, do not
  RAND_load_file("/dev/urandom", 1024) if the the PRNG is already
  seeded. (It always is on linux)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423396801">- Remove xorg-x11-devel from buildRequires, X libraries
  are not directly used/linked</changelog>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch
  * CVE-2018-20750 [bsc#1123832]
    + LibVNCServer-CVE-2018-20750.patch
  * CVE-2018-20748 [bsc#1123823]
    + LibVNCServer-CVE-2018-20748.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch
- note the correct way how to run the testsuite, it does not
  seem to be usable as it is, though (segfaults)</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- security update
- added patches
  fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
  + LibVNCServer-CVE-2017-18922.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594209600">- security update
- added patches
  fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
  + LibVNCServer-CVE-2020-14397.patch
  fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  + LibVNCServer-CVE-2020-14399.patch
  fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  + LibVNCServer-CVE-2020-14400.patch
  fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
  + LibVNCServer-CVE-2020-14401.patch
  fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
  + LibVNCServer-CVE-2020-14402,14403,14404.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- security update
- added patches
  fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
  + LibVNCServer-CVE-2018-21247.patch
  fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
  + LibVNCServer-CVE-2019-20839.patch
  fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
  + LibVNCServer-CVE-2019-20840.patch
  fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  + LibVNCServer-CVE-2020-14398.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS
  + LibVNCServer-CVE-2020-25708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
</package>
<package pkgid="7320518202713387a7773f1e9f948ecd83121341a903d0d88a5a2e1f191766f0" name="Mesa" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9f9b2c311898e3dad55e89da1a0d8c572f37fbcf6b2db22d80dbb7dadfa5d3a1" name="Mesa" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="aefb4e282bdb8e8418465099a2e591b6536ef0c924e0cab6911cd773a22efa1a" name="Mesa" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="de737a0a6ec33128ce0ee0d910f38e13b4e7daebc383b6dbf475a8ead133b464" name="Mesa" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="ccb1ad248ed2f6618f17ab95ada9d6e3b6adaf735cb4454ce51eee8d8d820ccd" name="Mesa" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="dbf29aa408cf3981bfb15607fb09404508503678cb3b8f132b0e87dc3820daa8" name="Mesa" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="89f19d7e6b2d25bb8859db46d585060c1872e910f1c4dc6a814586443673a147" name="Mesa" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="fdaf153a0612522698895a5c07531fe1fc62b67a1d6497bfc5e2fdbda80a05ac" name="Mesa" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="8cf24653ef89b8756f236bff5c548f4ef16fbe721c25ecf27b5fe22bef3fe4c0" name="Mesa" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c9ba896a232ab517688e2cce5f3d6e4a1689de4e0b5cdd8b4e72b9c1bab133e5" name="Mesa" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="201a155d32bdf7901a06dc68dd6487eece0253ca67b2509ba322a7f9f97ee9bc" name="Mesa-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="290079d13de4891b358a96595c50d66e28d5942486b0ad6bf242242e4e4141c1" name="Mesa-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="16a515bf31f80cfbafbcb0eb8235c78b8cf71c74e4dee496a11e5a19797e1658" name="Mesa-KHR-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0b876136ca96f39ac9077dc420e8a58ad12d4b5f74871199b22c93d32e3dee64" name="Mesa-KHR-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="eabdbca409842b53d66c80c69785db800e3d22bbc464b443d4d9bd27d30f9b85" name="Mesa-KHR-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="8451385dcaa8b29d624093dbdac56f7e21b415b8891dd0174ba16450ea2d0692" name="Mesa-KHR-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5eab6bed8add1e48a240ef58d6a838670673730dd46323c343ebc2cad73a18d3" name="Mesa-KHR-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9ad0ac94205faf33c56c76ee6d3f583e68562f90c9bba0044e32efb6b644554a" name="Mesa-KHR-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="732707592691963987ad648e78e79fdc789a52fe4aec39bfd60d9f8cd0966d79" name="Mesa-KHR-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="8b2aa63d862589a2b663380636b05ab38eaa4e569dd356868bb316b78090b66a" name="Mesa-KHR-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="2ba13f7cc351d75ed4da5723b4d0fd6035cd430b3f482609520365cb7bbc1511" name="Mesa-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="544cfe79e23473c6ac94497e177094f189871c51d674161792062a5c8b37b918" name="Mesa-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="2a65194f1c54dce88ee9ba16a0901801013a2bfd680f0a2d64021cb00a689e57" name="Mesa-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="7586dc76632d612d23ab127ff12c4a08517f60f3647080cfe3ca6c63da45c367" name="Mesa-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="c3b287bb55f40e1071eef696452f8e02d4ee590ca290ad83f96d8227238c7e90" name="Mesa-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6c7186da253c08980bc125c9935767c69ca272b8727f70a9873d38f68e9fe2e7" name="Mesa-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="d804dc8803aea3d2329df6ac0089b2c315effc313af429200298f68febaa6151" name="Mesa-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="7a57f7669e0eadb584b6f0b470e6d36ff3c8d8b94ef161ecef2c52a5c0aacc17" name="Mesa-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6bf6f8bd010f630575ecbe89d42e37f1a8f584160496cb3e58ebb4cf5e460a71" name="Mesa-dri" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="fe15efedc55279af88b8c570393c4003d815bf73bbd871b8eb87090a05a640bb" name="Mesa-dri" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="1550246260b627b45e93be721a92525b07b3f4ab543cbd0b29b5c7e4462bea81" name="Mesa-dri" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="4496d318a84b0714d6ce59bd9fbb1e08d94bbf509736e8053a4ae0420e733efb" name="Mesa-dri" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9082592d96719df054ea08d85787b042e4ce799c7533c3fe16d144bd9ae8f6bf" name="Mesa-dri" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="ff5c58ac0d3d5d9dbd725fd05167a502904551248dca9fb652935b4f741daa1c" name="Mesa-dri" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="cf7948348858fe116a9309eb5f330270b38352ea3a82ecf8127e2604605acfe7" name="Mesa-dri" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9a11b34e36be213d888ec4e330f35a3b5da76b959a4089d3242bcbac80afa72a" name="Mesa-dri" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="4f85558135ded69345cbd53f7d9efb48744a76d9642cbc9185de47a9d32fa011" name="Mesa-dri-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="23f72b7934c0baf076c6766599b712693bac1c23d4513d06a3bc5fa8050f6e9d" name="Mesa-dri-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="2bcf6deb62f8540d8cbbbae060a864d6b33c716d66907dba5d9be1ba57faca8e" name="Mesa-dri-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9e08de1bb00888efe8cd0b041ff7f940cd515c3af4a1800013b000483fcae3db" name="Mesa-dri-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="b020694a788f70c864550890e53735bdd5da69a2708f27013467fb656c4300f4" name="Mesa-dri-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="48f9d8c69f7b7ae0e367ff0ff2b6f595f3ccaaa2001ca904ad439df1ffb7c8d6" name="Mesa-dri-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="2023746b7eccbe8b1533466a89f971f699b95a1b8ca1b4e9f6d9e62f27d1eda1" name="Mesa-dri-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="078e1c7538ed4468c5d291b24e5462a82f397f2f3b187cf9d06b04ad286d11d0" name="Mesa-dri-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="39c55259e8264049f55fd81595a1dc07db693ed8d7b325beadc97e98c1f88740" name="Mesa-dri-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="25a6d6500f986827c131d15ed3882e28c7c4d287e546ec76f8fbdb0230a84c34" name="Mesa-dri-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="108d8ee1c52249eefd233e2c0a2bc9a0adc223c62bebdd8c72dbea55c44667c3" name="Mesa-dri-nouveau" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="441807de6979a78410df4fb390faec8def63d13c08bd1312489b229d023bfa51" name="Mesa-dri-nouveau" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="6166a0b3895842923f05d988b773a0eefda7b8346dbfb3c42a8ac9c1aff62349" name="Mesa-dri-nouveau" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="8f0a1aeb8dc716a2b5bafcba68a115dae31bb59bb0b11db1368e8890336702b3" name="Mesa-dri-nouveau" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9066f2c5d0bda9663277673582298fa2caa0d5da75598a15852083c4d9e293ad" name="Mesa-dri-nouveau" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="ff5eb12cf159938565b2fa16c31161c69423c7bd42a6033c856e76850758dc85" name="Mesa-dri-nouveau" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="a4f907f52e6b356e03d02747a7a638a395ad1740825d355f0fea59ba49887da7" name="Mesa-dri-nouveau-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="afaeb39cf84bf2d1fb2d8bb85f127bc3d3906c06bce1c81e36fc69b51ceac0b5" name="Mesa-dri-nouveau-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c988ad99630c8a49a5494f7eb11f50ba1b8fd29bcd4aa6730f226e47e3100159" name="Mesa-dri-vc4" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="f8f763b4b619ed508e446870cda164e87749187ddc7bc74721a14c0cf8dfef99" name="Mesa-dri-vc4" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="4d273bafdbeffa8cf050023ba304d130df954237399cf16d0e7573394e3a8f82" name="Mesa-drivers" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5db4e403c8908e9e086f0f58979ef1b38fae87bf3879f4b08f5edb6fd9b2390a" name="Mesa-drivers" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c8da1faebd79b8e9e2b3637bbb918ef25937b01a7479041144788dbe105a09d2" name="Mesa-gallium" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5ea04473b0ec36fe9a2aba4b27b7cb7a2bf79e69b867ea7982f08da665475f42" name="Mesa-gallium" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="01e5cdc64c2714becd7c1afce9caa855c445961677b0a259ab1dc229871d3408" name="Mesa-gallium" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="22720e2e6a0997623b39626524ed5cdbbfec632aee76ec25172bebe6c330e65b" name="Mesa-gallium" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="bc25370359604a5d740e56387237c8edbb1ba4949cf6328e457901f8d9f96f67" name="Mesa-gallium" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="e5728b3d542466ca16befa68171750fb9a67bd2b3f1e98813250e3a5c18dd699" name="Mesa-gallium" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="5604f7259ef17ae64fd857d58819ccce7f26301566e9ab286ea0a685df762393" name="Mesa-gallium-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="f59fe8a8b17eea604b419d73192c7309411c86ec884cbb3f7a44d4ea3204a5ac" name="Mesa-gallium-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9f5bfb1559eb62dfaff6b225f4c7c9170ad5dc358a41677bcaa4b15de304f5d8" name="Mesa-libEGL-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="e6f00fe1d19e1a2c58aa80e6184ee442c3e31e4195610dbe0af28fd7c806f8a5" name="Mesa-libEGL-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0da468240d93a5b8d1e6bb6a4298a4621a69ff6ef91f5be051598434480aa3fc" name="Mesa-libEGL-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="d1df9237ee8c896a7d8c1a0d633944500a79c674b1b2173cb86240357ba30e7a" name="Mesa-libEGL-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0512d18688df83d1734cf2c819a2635ccb386b6453dda4a48b7a57ae9c930d98" name="Mesa-libEGL-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="da135e0b86c4d99be5e54691043bdd01a813f2e28dab07b28f4319bb62a4b6f6" name="Mesa-libEGL-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6342d5254a9c5d45f62ba4d3086edc894c436b7d0843460de32a94d524592696" name="Mesa-libEGL-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="5bac15e0a72ef2b49d1d7752154f026a06850e9a901375761fba366b75ca944a" name="Mesa-libEGL-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="f32f8768d6e7278aa92a1c3bbf6d2b1cefbe6085f16966386fc94b2255b0361a" name="Mesa-libEGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="4913fac27da60cbd61600d35e6970460c6ca7961310590d84785b99d45a87f7a" name="Mesa-libEGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="be4da53e0ac2f6cd193ecb7aa787b37dfa14bd11ec2cecf7b81da3a7db7dca59" name="Mesa-libEGL1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="074cc4a85631a022f6aed71339464333a30c653f1ef0dc1d614de17ff9eca51c" name="Mesa-libEGL1" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="fcc16e8b0ae8d6a0e0e2ceed73b00bc28b4767594233db3d1925bf5c04e0d5b2" name="Mesa-libEGL1" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="ec4ddcfd6d4f8aa97dc87fd78df29c8894d216bfb925b9f3622697453d535945" name="Mesa-libEGL1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="c08cc3df09b3b52047f9e7e53fab3bfba6c7fa42716e785ca46de870fbcd1015" name="Mesa-libEGL1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c23029bb3bbad4414c23162bce9eaa5921fea6612f4e011150323ec8176a8def" name="Mesa-libEGL1" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="1925fb02a8e134e807819da6245f33ca5ba9d7ae3f8cceafff481ef2ba1485d6" name="Mesa-libEGL1" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="1d790eaa4f555b6eeb98cad5d25ebb735d879777f9745052dc120ba3d1246f63" name="Mesa-libEGL1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9f1e463344edeb305cd9672c3d083d1599a814cadecefdb2bed4d655bdfb722e" name="Mesa-libEGL1-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="28fa3e11b1a7e700ec79802cf375521a8a5350a31f747af2a5dc2b7194cfcfda" name="Mesa-libEGL1-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="cd2b54698f733a4dd8a9cae91310dee89f91899d89f6345547c4240f3643269e" name="Mesa-libGL-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="d71cde8f0721d192ef47da34553d78833587d108c07977139bed897c60e81184" name="Mesa-libGL-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="91f25c5e6c01ef96e3439996bb0aeede39b316d8fc94ee7c8abc3eda35982fe5" name="Mesa-libGL-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="f514c163ea42a475f2b8d947cd174edb04ab1aea0a7793cf5419d7dfa4f2a86d" name="Mesa-libGL-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="095e242e6ab36cf3bb0c0bac18ab6512138f4f3929a37ab34d8abeafb158b1a9" name="Mesa-libGL-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="287b899b97ecf65b65772835a87fcd8995875e116b5e514e1ef7b8aa8cae26ba" name="Mesa-libGL-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="f857b9c6a8b6d8852010580a1dd13e75b007abcbf0010a7fdcf5ce0636819277" name="Mesa-libGL-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="353f5f07b1e5b871b820facc0b895b5dd9d2114a6f76aa3b6d4f574c05a29516" name="Mesa-libGL-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="984c4059973939bb8b96d3541799127d63b30f4d8ae4ac3e2bd364e2be614d7c" name="Mesa-libGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="667e36dc78edbfe1a721d631719fa3f70040a81305ec8116a04ca00613e13b09" name="Mesa-libGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="bffcac1e556e137b4bf5ef9dda7d05c1c0a8d4378b61913007141f062e2f9602" name="Mesa-libGL1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0e93ab06b3d0ec0517b6a4af8512853831ac72d0112aef398adc892c9854d81f" name="Mesa-libGL1" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="416cba8d7515e542c4fa7ae04a9bed55b46567979edf3aefe71e5e4a4b61e8c8" name="Mesa-libGL1" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="a6e33f02025eb2a8d86650f598aed486160b7019ccb788a3964f0cfe0e6ce528" name="Mesa-libGL1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="d803626fea82613d71924989a9bce0ab47c67ebe0ebe0461b82bf5e602f03af0" name="Mesa-libGL1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="99a4502b2e1a8928f544373ea31dc065c0fa75232708ef38b40d91ac15d964ed" name="Mesa-libGL1" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="803f4fbb3d08b05ef5320136a8563441450a891ee13994c709b28546c08b4845" name="Mesa-libGL1" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="e1811fb3ac81354d6c63fc8ed037570508beb4dfa77a683be6eec1d947ab2c8f" name="Mesa-libGL1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="a58e92d1ab2b0cad96744f6168d7004213874b77ad7394dcac20694c41b7d5f9" name="Mesa-libGL1-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="59d98face20b03b07bd9e69074a5dcbb3b339ec4b4e08895cd80e30d0b182ec4" name="Mesa-libGL1-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="52b75045eb06381a6079bcc68c6a3677edd07ec975f8c87a378fe2b94bd647b1" name="Mesa-libGLESv1_CM-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="588f2d2cb41d193db145714dc82d02ab61e9ce0ac68d25c0d77633188b1dc969" name="Mesa-libGLESv1_CM-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5ae92377951ac7cfc9d9de5cb6c50df69c41e6c6b8384945eb761b7d23b17a4d" name="Mesa-libGLESv1_CM-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="679302a591c7e8fce7fc969e604a9a745d369b8aa5acde3862523fc8e7bea3fd" name="Mesa-libGLESv1_CM-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="bd9f2431d8de6869204f718b3535e89bffe64969dee240fae080d7a153765265" name="Mesa-libGLESv1_CM-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="a7e47a47479baa964b6f71f4caae1bfa049565deaa749717dc4074eb4fa43904" name="Mesa-libGLESv1_CM-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="148c8036b312b6c92aa911a55e4ae27cfef33f795fd13e57510d17af60eac311" name="Mesa-libGLESv1_CM-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="42c388eb396705fc393561ea7474248b81f03dfe3ae588a1fc92cc74be556dfb" name="Mesa-libGLESv1_CM-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="053890ac26b19d53833684092d21449a388f1845c2a9d65e35172fc0e4b4d5ab" name="Mesa-libGLESv1_CM-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="f7f1f43ae8a77c66c58a0710a257f478e408f6aa8635ef699bfd5acb4a9ea761" name="Mesa-libGLESv1_CM-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="60fb786d9bfdaddf3447fbd76c5e9aa9c3d471616360251477763fe2c9a1fcbb" name="Mesa-libGLESv2-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="83dc6f0db742b999d89cd86056b044c68ff14963231fce576fef6a02f5c984a6" name="Mesa-libGLESv2-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9589c3ea8a0d5b1196955edb3a7fa2017799cd9c35cdefadb0e97d10a92b1111" name="Mesa-libGLESv2-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="8f408d4fe8be166cc132afcd9282daf112b6c3a387e37b431d5380e57d18950a" name="Mesa-libGLESv2-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="ca3cc081214e94d575a343f1aee705e403f2772cffd2b47538fe200998497fb6" name="Mesa-libGLESv2-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c1b1e80acf7856ed76f235684121dd46237ece3db8ecf28b21a1be229bda7a08" name="Mesa-libGLESv2-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="d5d5425ec200bd1e20ee392fbf53901146af1eaacbed06ffddd94cf82d645350" name="Mesa-libGLESv2-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="bbb3702cf75bc49fcec61be3182dcf08f96a43f549a952304144d42732286728" name="Mesa-libGLESv2-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="fb02df0ab7ebefd3a14abec59e03189af66e1c081c06c82b9d688ee6985d1863" name="Mesa-libGLESv2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="f0e177a8626c497ee872c5496f288c20bd6f913546fb40b15b617f862e4e7cef" name="Mesa-libGLESv2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="d42b324b7da5b6ac55cdd54b4be824ea2f757da96158b4d260f0135dd648a728" name="Mesa-libGLESv3-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="57020270a108bb652ccd96d1966542a2954863f9f69301bfd3d54d745ce0868a" name="Mesa-libGLESv3-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="a1c79ca7b6864720760bf7661966555087ce6497747d9444d00ec2af5a625017" name="Mesa-libGLESv3-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5c38f123270bd974e0a55c3b71236dfa0421316d63597a32cd6c83162d38abff" name="Mesa-libGLESv3-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="13d98fcaa6a65545b9d8771a288713357aac97127c6e72334ea93be2c647debf" name="Mesa-libGLESv3-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="253eb2df7558f1df3e4d7a93d4303c261e6ac312545a77d41ca00fe2f421b2be" name="Mesa-libGLESv3-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="ca9ce9c7fe92ee17c03b10a0df7ef8a0548dad6049f72086bb8fd59632cd972f" name="Mesa-libGLESv3-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="4bcc63fbf16d441cf0c373c111bf3c753787b62ba804e9ade233abf5b6824eb7" name="Mesa-libGLESv3-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="4ead2f607d2a881b000b4cefcc01d3b7ddd241a4cbc0ea4c3408a3ad01f5da59" name="Mesa-libOpenCL" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="d87434c84adcb9218a073fd7cdfed34d050409757c26b74e9654284ab771ed49" name="Mesa-libOpenCL" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="15fb33a977ab6c0990cb765ba8b030f034ebe817b5fec7e205a0a435c6cd2700" name="Mesa-libOpenCL" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="89d7c9aa965a1b42d6400a6534a2366d9b0dc908a49b3ce7452dcb6ce2882568" name="Mesa-libOpenCL" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="5ad82e63f807df57fd6383d203818e9a26130d8ffcb89f656da7e7762e42b492" name="Mesa-libOpenCL" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6785acea98953bf6df5702d0cdc55a2a53c5dde16c9b7c3451850ce9742ea754" name="Mesa-libOpenCL" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6e61edda0693f4b8dae69404a04d157c94a0b5f58af343dbee1e1234a599df42" name="Mesa-libVulkan-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="e9344d3e70916ee2365cc25c542436c403dea340180a9f69f77222ee29c2e2bc" name="Mesa-libVulkan-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="4fa78f5c84a661ee8fe3d8200b0a96963392abb612b723d40ddffbe2165d4b2c" name="Mesa-libd3d" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0e30c10cd9548d73b306d1b5aae9dcc34d4ba07f5bdfb545f2fd50a4450bbcf9" name="Mesa-libd3d" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="1b7bc6be4f9b942d67f1b3e24343c0f1323d3d9aa5842402269c0e646e59679c" name="Mesa-libd3d" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="3840df93311788b3589f4e877af3fcd9dd5bdb5b034529831a91b3851f065e59" name="Mesa-libd3d" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="bee2f6df99bdf0232998a8f8d895d2fd35072e1ea173a13151e2793153ec79fb" name="Mesa-libd3d-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5a541dd01444594319842f7ec9a4a6a36e7a1b869b890546705ef8e9ec94fae2" name="Mesa-libd3d-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="a6e52bae891605c3a841f2350c6fa4c7d18089a90fac5558c0c35c21c8f9469c" name="Mesa-libd3d-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="8bb4b3e5b9c1b8fa9237c109d1022bbc008e59bb2e01cdb5afdc4b94ee0d5159" name="Mesa-libd3d-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="4efa89c09988d0be1d5dae6668fac2c50fc4abfb52d1f6defb0744b497a39d34" name="Mesa-libd3d-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="2e24ad08239e16ae12657b5b596f4e24fc617d43ee483e87e361b0955d5f8e88" name="Mesa-libd3d-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="35548b9f20bd851082fc0597d69960cfe4dd97aa9ec795349221d67c0a6a9b88" name="Mesa-libd3d-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="2f8a27f2754ae73df1ac4fd55f011fa9c18ee1ad50d8983e38c0f534aa0edd9b" name="Mesa-libd3d-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9ad15890a5361b4bd240379241a49aba282724ba05c851c148ab48c5906dbb06" name="Mesa-libglapi-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="86c1c75a0c8b65cf6b9482a9d2fc40983ccd43d5ceef1e8ed7ecf99b010731c5" name="Mesa-libglapi-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="edb894452a95896d6d8308a5fd94b38e9dc3594dfb52b2058168ee71b6384cf2" name="Mesa-libglapi-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="6dfb1a0567992e85bbd60eeeac0892bb136cd6d2285163a90ee68cd303f1cdeb" name="Mesa-libglapi-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9ee224ed5eb695c53dabd34a1321a351453cdfa0d1eb0f7786c259b0596f041b" name="Mesa-libglapi-devel" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="3369cc5958bec0252383f67127f077777dd58a95de800eb0636babcf36fa35c4" name="Mesa-libglapi-devel" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="b153187f979a31aac65b51faeb4f6d60fbe26f17623fa072fad62b0116ac7269" name="Mesa-libglapi-devel" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="34e7ddeeaf9de7dd5ce1de1bb9c4847c6e41ad5898578092d7dc5f56568d0b61" name="Mesa-libglapi-devel" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="18e31fa70de3eb5a939f7e5d4a80321ba194e1fe8569a469a3e195cd743704e3" name="Mesa-libglapi-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="7e291d139d641f6c6045dcd7b0863de3efc207896b292901cdf73e8dee56f316" name="Mesa-libglapi-devel-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="160ecb63f5e65dedb91f1b50ebd581066b415d343ebfc904186a0f345588c2a4" name="Mesa-libglapi0" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="ca84116ec53061acd0d17b2dd0a4d95b16029a65b2a1c6ec74fc4c8119f48cad" name="Mesa-libglapi0" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="873f8ee5e8003548f470b6bfa6ceac3a5d08cfc361d2a9b764eda233d7f9ca8a" name="Mesa-libglapi0" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="6170c01d46ec4b79feab1a1d5381e4328ca325f9134f73b4d80b01729c32446b" name="Mesa-libglapi0" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="0df016dbc521f12c6b88de6645b80f3ad5067f677087503a4cf1000954931122" name="Mesa-libglapi0" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="37718401c542d8663fa9bd98759ea9d44c0fd880af34390dfcf9dce6aab009f9" name="Mesa-libglapi0" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="57d695ed03c04a933ec046b18e87af33a5dfcdcc771fe7e9b315cfc5ddf71d49" name="Mesa-libglapi0" arch="s390x">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="b50daba1613a860e62911bf4f28048e2444e1c9e4392e1a5d88ef75e7bb992bf" name="Mesa-libglapi0" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="6ba96d45066b6befda5a4577111841e13820142cbe2b8cb515c269c6384130b8" name="Mesa-libglapi0-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="7d098f9633d900420cf0fa8d6ee88fceb22992a33464d51254344562dc750c05" name="Mesa-libglapi0-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="5d8c7ec157883e00585a53d42cd48c222812179d8f17943b37f0048822099e2a" name="Mesa-libva" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="00e3ad3a1390528a39651bfdf6c60a80b500216f2a4b59ace412df0066acb54d" name="Mesa-libva" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="dc25c01d81d148c9313620a4bddae1618516961ac51ac58da12cb76dc7e68916" name="Mesa-libva" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="2a1a3c37fde60f7d1703cf3c2889e1239b50ab9a31edc1a4da80069c42b91ac4" name="Mesa-libva" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="3f8ac6d65fa136b41d187cbeedb0e345b1285cd0ad87df9f4591d74f57577ea2" name="Mesa-libva" arch="ppc64le">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="be925958848e18084723d41a4c7bf89ea2102e3a3921bfe14a6e11b2acd06cbc" name="Mesa-libva" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="7d52bf1d7133cda41fa4195f340ab412e9428365f1527ae31ab1de3e97ff3518" name="Mesa-vulkan-device-select" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="971ca209cfb19bfbd6ac97f90d175794986b183a826bc0dc2ebb21c49b076303" name="Mesa-vulkan-device-select" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="873c025e12050cc8fe1f49f55e635c1ce8a00962b0f67d618e1bc6be34a2869c" name="Mesa-vulkan-device-select-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="9a509d73986cff72a4bb8596228d7f6d25d73e90354a81e6f99a082ac0d1205f" name="Mesa-vulkan-device-select-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="73191344b214b9f30360395b3b81964c25aa13d74ee0c374c8332d9afbf49d8e" name="Mesa-vulkan-overlay" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="e9a92cce7cecafc19b9778ff327d82a7abcbe5dbbb50b8666be3b959932f4671" name="Mesa-vulkan-overlay" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="9bebf4b11a1829dde767a9303e6b067d5d5dc5f997c8747a598e8aa23fd4280b" name="Mesa-vulkan-overlay-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="5235ecadb74ed0d8f50b100a544d3f62cc3c00f75734ae931f43fcfeb1fbaaf7" name="Mesa-vulkan-overlay-32bit" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="989f90ced529aba1a830c12f375e6426c541cbdf4b85266c374c1e96a59ab234" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="f1704470aba486d3a3068e580a0e78d2af6e865371afa19ab3acdb89575c4008" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="4a8ecc52a750b32d5588b0666443d3711d0794bbe81c4c3af38090a804fb7425" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="44c937db2ea51c00a414350750e6edb44b31499696d5cc9fc9615468527e2c51" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="4ea6f5fa181563f09e9f9674134bc80f19d59bb5b421257f609b567f09719477" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="dfc34d7c5c07d64b290d46814672081e4b67fab8331c660e2723fb8f96328824" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="721e3208f99d5f798d94178c215b917bfeafa7139afa2b9e8148262dcbcfd0e3" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="c80aa3dcfc3a3fa40e9db5837a9d6735f74656c8d2a1bc85b9bc72e96245c4c1" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="b35dec0f1bfaaf644f3b6e3b9c6793c7be3f68e75cd10234cb323dda20011d4f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="182d668917498e275e24fc00f151a2b5c31e4f08a0004d187b44b4fc2e54be60" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="9cc97d8854a340c0bf745590cc6a763420efd063f2eeb5b508089692d37cc3fd" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="64ea77ab38abd45b54775c42f299f146a5e57b56de75c0ce641d630b1764bba7" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="4c29c8825f8edfef160a35298ce4494dbb4c2e928c0327a085c26b6d224e0e39" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="7265f615d06ec1d5666818442aa96e2dc24af31e2a751242332369577e8ace9c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="2e64e06ad5c7e90929ca6d6beb718b0c387279bf7d319f386e44d64b0492b214" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="2c125fb57ef25029e469a308b99f65ae5d43f25c9b9e41463a506cf868ac8b00" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="082820fc9a64adfabb8ed08413cbd139d74a88ba047439e9d333fa873f900c12" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="a3e498de38a582a6d776aaeb9d7c7fc2114ab47a3fab67c2b9fe63b7fcd741af" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="ea4cc0e2b521c8ecfc1939a3002ae95f8a1418258fb8912bf8d5dd37904a83e1" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="1be7f2de5e75936eaec3965e1bdfaed7a464c0da7f4c2e8f891abf44079828a2" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="3fc38d6a09627f194cb932a4b038910609a03faff897bcb91d5b0480856e0d8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="ed8a696492dfadb62a8fbfb9037a21aa94770536df040c091dccbc0c038ae59e" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="56fd28862ba77cd9b5be6e21c105b788823bc6310f39cdf9dd635facf630d251" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="0dc1c00d2fb564f7de095da9612d151d5fa0988e8a57f735cbabe016fa4f3498" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="8d56403fbf56038278e894819873b5243bac9669bf1cf6a28ebec9030e9e89f4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b03c4a71506cb82c48b0257acd1ff1a2498bb6507fa9c96f249ee11f13191249" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="5107e1613dfcc6c4e577723009e9aba4ade4e3f720c25c6c30d7476f12150156" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="18c1436e7856e9982e2446082e1ea49beb6f34db44223a7930d6712eca85f9c1" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="959ec8d7ca7cec5fc09eabbd511d47c74a39a92f4132e714ffe554587c66ddc2" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="e9581264ca358c67b744697d738f1d9449a46f6df94f2a50abf6b7f7c3cdc738" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="07f7adf4ee3f36960880aba26cda600b3082ac9bf67f3e22937b66602f15afe9" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="5915b07fe134d4cb960c7b8d131e273aea1b05c68e52fe1db13db9cdc52bad1d" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="bf1c185e8f4d366bc0034f7b73ae644f32359b6eca26152bed3599569e3660a8" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="3046ee91a167e4921f6309bd2e424aca7fc7e1221b0f071b97e39a44e28ef24c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="51ed4060763876b93d7179ef8a8597288b20f212159da03b769e8f8ad3c7191d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="2006ee9ee6416407475dea69bda89c6adb9266b3d557aaf7c2cc7e2e3ef8a505" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="5cdeefb7ccc3fcc91ab692bdc25e20720839d1164aff107374c6dd910fe3cc7a" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="64d8e8ca81e39a9d57bcfe32f1cb073d74c262d54b5cfc4db895e503cb31dff4" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="44f5edd1806f36cc011fefb3bf0394cef9b621ba05ec25f77bbf33586f844fc7" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="c09ca72e081d7d8271de1121bda9caa034e4a5da20956c89040b1975ede1a736" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="0fe8191c54c8a0c87500c5db9b29373985bb9e9032d2354a1a1eedbd613288d5" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="badb9e901cd621f1ec559481af6d8d79c7a9f1fabe0ad112c888c18f6fbf356d" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="1ad745c7f7f386f6fc231c82ffa9d8d901e17429e5edfdb48f247e44c773c427" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="ff1c4456988152d234889b4c066ce88c65dd05515baec3d48145b12980bfb0b6" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="b75f1159e96290ebf3f73c28f744a6f1a12c9f7694c52bfbd70ac6b012ba2b4b" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="29cb18ab8a23bd57fb7b3944c89e36b0a84c483a303c7abc80d8660949a11f94" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="849d2347d00b4ae7ec4bc8c2b89a63823d3cb9c978679897afe74a133ca3a544" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="1270f9c57c8d3ff34bc95bcb4cac96c63d2cce8e7d344fe0acad67c81c32ad24" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="44190e9029aa6f68fe3da66a19f5111e8210ef158bbcfe64c762aa31d0f53d0f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="f898adac86cc02155570194dfca38b1b2343bceb00310439bff21409864c8778" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="795bd3bf84dc69c3bee8c74bc7216a001c431ac4e660e7d0ba817b9a637cd31d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="0ff631a633d84bc10c7e64f6a92ca5c13eea2482b4d31bf64ebe556d6cde6eb2" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="fafbf93690972b57548d506bb892fff93b6547218614928e1629c1c98f0f9bb2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="f8210e0bbe7fd96844eb1138e759638f11caed34411d8602f55b166adbf277eb" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="2cabacbb33ce7941e4d6a8669f60679532ec63d1e812210874a89ab54fa48efe" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="2e30c91402ed86969812d1ae9729a5b6cfa95be16413f97f9a3f674b5c4278c2" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="53391686b83ca41e599e9c06640e1279fcda4299bdd8ebc1b8e73b7f91b157b4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="490d6c8fe6f96047cd5e9e51763b8365b1c7bf06a3f7b2c441ebe1128eb8ce19" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="8ec109047d16b86008a4dd7987ca7f472fa5786ac6e4f8ffc0d1e48070f803b7" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="bc0fa15c331afc4bbbae9e9750d2d1732691c5e807dcd6a6eeecf3622df7eddf" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="0ae23e120075e63b940721ad22088c382c32af25dac9135189d5cc0e12ceab1c" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="2f15a7318bda7f5fd578968659294d20228618c3b0931b46528a798848329238" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="49da31d1972f5c339fa0cf48cee70cf19ed59134a3b377b1f240be9e1cb42c7f" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="dec47ea07e60c734b2de3bb8efd75b896495914baf33c546a1541c7798d21400" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="af1c756821ad77aae10be601044347d0d154ac98a164b14932ef4670df9b292f" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="185d750a7ea5a49f8b3dc7200560b14b9f4a96fb1fe5e534b9a43695e5efc487" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="3c09ccfe7ad097e2830ab9cc7461a3a379f029e4d1cb0b4f562800272f5802e3" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="4b7bc7df9f2b00744cbeb082c68b07df398eef2ebee5b76a4e651a20986e7fa8" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="fe5941068a41045f659fad7cb977dd1c9cd4001bc3277a9ec4600cac96bd7e87" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="a2487728ffddb6f44ebd3136ab84221d97a042fb445bab8baaa8c1d44f6e53bd" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="bde1a20f642659546cb22e5efc97a1ea90d1e734e0415d9a5ca22dc09ef6300f" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="fe0a480efcd8e2896c7550b64091b9faf1471b59164b5f59e55a7c3e08a2601d" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="da5e8aea4ea3a61e38badf1d9fc3804b47d6acb3de48d5b12c3515b1c7293b91" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="e2f223ef2cb11e3d87afb7c451935b19d758f60a97f2294e3b9df7f2dc231577" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="a7f15354dcdc908741efa54c46fbf9f18a740deb391b9e9e71ae7eb783c3e1c2" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="44afd16203a41edbc348bd5a6da52499e8e08bd682f1598b96577093be9cdd67" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="c4dd3dcf9770143619afaeaa4b980452d4f79884d460bf382693e48b60ce2528" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="a093759127dcda42c5bcff7e7faef325220237a7b83852b9d6978ce0065f6b08" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="ae104d5691f10c6c57b5fa036c623084ad58b60923a93c4dd0637217183ad0eb" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="3217538fb6643993663516aac14d26f750fa6c788878bdc498f0aa2f5fcd73a4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="3ec69482956707a393078828b035d22544e2708094d7bcc303a28532e261083d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="d82f741563132e6d73967ef39a767bf7503596dfa0f325322cd93dac741c0dfe" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="e093a330b353385100c40f4acf6bdea703e2bfdc781e5fb1cf5fef740dc0e686" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="dd0ee0dcc605959d5ea099aaf12d33fe0117153200be6c71964bc98c3d6e092b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="4e5cc61d3229168ff21043a489eac5085977f2a3480d2a59cda1dcdfc28fd09a" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="88e8aa6f0b53da3be240233e164881ae5f9e8b5ae741da5694036dd223e9de3b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="ec6898f7adc0150d6f746ce7aa775d56b2a623b046607c65b126f4757b2280c3" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="fcad4876b7ef35c314e1fba9f5d67c0361d482619a6547dd9deac204dd35031b" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="bbd1aac214058ceaa22901e375a0aafc195c2cfea011028d96fdb2c2f72e93c6" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="534b44b5cbef9fb417834e4287d2c927444e4dee2059c2bbd249a8c0e77d1dcc" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="be66ac0d7ec83f1c20672b8c9798fe33af5e0f9c4be32206dc3e1e58227c14ae" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="eaba070bdc95a2d023a32a3f95cabfed82b09bab52b48e9c16761ed5c97293db" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="98defa53a883eb7d69d3aaed9c011969f2c187e6777884e1862f6c7a4697c729" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="d465402741cbe916171068d25b37a38e121c5aba27b9141c560ce8c7b81222d9" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="17f7a39a42cb093c0b7dfede22ce4265446a2e720b47f866eb7754c640023a20" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="77ef3002dbbfd5220ba21d958112330e74a559be0a45d39506a8cd5c1d56ed1d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="bc112b26a488b770e8d48ca5e358de241af4d05c8f841125bbaf7b2251ffe4b9" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="d7b7341f55ffafcbb7e44e0a6dd030bdc882f023803752a33bd4bba98119f97f" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="1b1d6ab8917bf8593b0bbe1819c1cd30ac9e0c08e8a87548f49bd2dba6515d65" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="b4b522001c567fbc0ffcbedd6a89a609753f3134adb142f564082575ceac9256" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="3a61b8b4ccae359659d5a945fb307cde059d0a244c61e4373b4787dafc601003" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="39305637ea2da6b4fdee29c71383fd1ac13957dad8441e28e12f71818c5b107f" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="583916dc9edeec647747cc97cc4bf88894210980d16b014843f1e3b541367fec" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="1279632df277b95542bc2a578349d6831fc31e9df43d6a4651de52732416c00c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="802a9597d830fa4c5c05dbabe0920c0aeab5bdac9051cf8c501014cf5b93abf8" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="fd566c089940493d575733907ced80bac4362d660db26e0bd30d66071fc46aa3" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="4749644cd462e83e05a6ed8069011a78faa85eb6ef196f3b5ef4cee5d7f21ced" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="6ec4ae7137febf25da118c87479572ba17735558c1c7301fbc984fc6b8c66303" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="e022a705b8a45bbbe4236329283664b11ebc4a8326d63659bca1a0a42357dc82" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="71f9acd09803c626a981f38ccded72663c8e095342b94ca5e72e14496c228752" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="afbe22c23e3303e237820cbdcddbf37520fe539e9b76786abbee609a801bd4a9" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="fd23cccdac7f92c6bbbefabacd7feaec0bde31e59a34c2e24c91157abcd28bbb" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="a308cbd0ccf520779d6af8020a5a13ee315d950c86290bf02dd3b8d9349601a6" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="12d7d5257c15680abedfc187797346988b22810dba61e466f22220c7da45e686" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="e1f22e5cdf61a271ba570e91d83083700ce2ee7c6b4bb221e1bc7326bfff4d74" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="9b70f58e416ff8bd627c644bbdfb5b2a5fc99be54304a307e7ea82453c59ab0d" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="102" rel="150200.9.10.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
</package>
<package pkgid="56defb51653b85587a96cd624c5002b9791e36a0844da2a41873eec1685ca8ab" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="102" rel="150200.9.10.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
</package>
<package pkgid="c10c450ef079c6d7f09bf6e79469b1cce9d8b1b1007c4f136f1e9bcb508c0922" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="102" rel="150200.9.10.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
</package>
<package pkgid="0d29e11a518ae50063b79a4f89f765a18ed724ceb501f86a1aa50a1f9f1e0439" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="102" rel="150200.9.10.1"/>
  <changelog author="pcerny@suse.com" date="1392811200">- packaging license file</changelog>
  <changelog author="pcerny@suse.com" date="1396008000">- show protocol in URL</changelog>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
</package>
<package pkgid="2a93aee328dc975f70cfff1242e38a1666b5ea5ee853c6daac5588af2f872ef1" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="102" rel="150200.9.10.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
</package>
<package pkgid="6736d394c0c0c81a362b956b63dfaa93f6bba832d8646aa87ebc71c927915846" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="91" rel="150200.9.7.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="045657503e8275ec6bd9fb18dedd513011ac516605f0e4d2b9183c80ba62f434" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="91" rel="150200.9.7.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="530ce84802bbbc573507aaed49ec76a43e8f73060aee078328cc74de57540a40" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="91" rel="150200.9.7.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="4625b3f61fb1c34659039dff6532e235e043a7c525d96eb7ce042ab8a08a4715" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="91" rel="150200.9.7.1"/>
  <changelog author="cdenicolo@suse.com" date="1392638400">- license update: BSD-3-Clause
  please use SPDX-filenames.</changelog>
  <changelog author="pcerny@suse.com" date="1392811200">- packaging license file</changelog>
  <changelog author="pcerny@suse.com" date="1396008000">- show protocol in URL</changelog>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="d5f87ecfe92c84109a2b670b26ad97b5ef2d1fbba5b243eb147a833c590cb5a8" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="91" rel="150200.9.7.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="8ff457890b7e411389ae3db6bffc888f652f5e99073866529b1785bee0d970a6" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="b8e7b3e2f58f3a939a2953c2a2bf339364ff9f3b96b641088e6276aa3f5024cb" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="171dfe34973653ba912d32d0af0bd914d8bf3f2b5f31bf5175b5384942e432e8" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="ed7ec23dff22a0be07c8dcac812f072bbaed42ec958139183c0eff4c4c20c41a" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="cdenicolo@suse.com" date="1392638400">- license update: BSD-3-Clause
  please use SPDX-filenames.</changelog>
  <changelog author="pcerny@suse.com" date="1392811200">- packaging license file</changelog>
  <changelog author="pcerny@suse.com" date="1396008000">- show protocol in URL</changelog>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="9fb21377b6f4dfba0a04c244e06cd5b0b082676091cdbe9b6f2010c2529995cb" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="8d91d76fbd80abed7265f46df1eb6f88301b6f126d986e7b7d4905e5d592fcf2" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="95808675538f185e53fd539f5a5fee8abaa70cf251ce18a19832867d3b0153a7" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="0ab967f800322eba15c34aef673e79f4db99b559d2649bb879d17eab27fc77cd" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="790f170aa6795d8e98fc5c23e7d1a9c7d16bce69e3aaee0cff7c735073ba2723" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="36c7d60c7849ff23e6d0409925829f2db48c57ed2d40ccdd7e7897813ed892dc" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="a3e5e435ce8ecf2f9dd48bba9953e2b39a5a3e4bf3e09fe27e7ec37aceb0f8aa" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="5089b70af76d0338fe40b9fd68490903ee6c9c7cfd4adabf643caca59ae54fe8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="fc4d99ac29668203786dfeaada3883da8dd6d71a64606aef2cb331cb33ccb969" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="bd10a004fd233b0fbe19f1756e86185519d908170d6761d56450a8056eff3255" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="ce6374f7b498534fa6a2fbe4b34fed6bc30d76e4bdb3ba0575f464b589ac2298" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="29d2b41319b89e8b999510cdd43a18f4180f7d4dee994d30ca8415638d4604a3" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="b9f1ed4807682271f93d333f13a0b79e93f38b6eebca9fd0594c24573336a19a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="5248e76674677c2edcec6d498900174d7f7e6a7275914c1c91db32778ae56072" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="182cedc41bffbd97b8ab404718fbdf76ce4c75f39b60d4831488a5b0be117dee" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="717b6d8e55433cdde689ad8d939a25b587a27ae8fea30d848ea988782cb2bd42" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="fa524b48f37de5bbd20a65211481a8179e78be8e26ae87e2463d7b2bd88148ca" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="5adffce5976cbe8451b58d88e28622d96d5038b45e044d074b1da7c57dac5325" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="20ea7fc7ed82381ae5a5e21c1804d99b88306c63a635a1f5cd26c17ac1ff2a05" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b6b8952aee701bb6f493d70b6aa2f77746da0a39b0cbe40a6c120b8de13e7337" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e542fc256ba709a7e6e4bcb7af6117e673bc30a7f5ad835ef52a0500feebff47" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="86ced91c05a948f70cdf8545cea9720c775f04bf03c8c6cbc67c34f373f8a875" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="7984c5e97643a8e6db5e2f7f9af54854d82d139b462dff9ee0e4c51b2b4ddae4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="c3af79d07b674c95186fec636979e68ea33a5bce71bd79ac8e4ddc65b30e8c90" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="258a5ae1164a256b731bb025561e328292a47526881625e3d1a3454304d59472" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="673350f5fcb5704b498b263fb9f70659025d3318c69c9309c3c6f36722e858ae" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="f37cc0891cc7e05726861e67ab653893d9961e61290870248ccb60406148f922" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="6bf4f138d81308c95dec54b2c88954cc46ffb85e01860ab4bd5ea0511bb327bc" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="86966753facab1ec455bd5ee063eb96c5052be5391ad7d60a6b15472e84ea464" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="3330bf5a33a60b57a026fce3944d8c12ff259e1c723ae56e01fb29da8ceaffe9" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="cb8c1b9921a382e9d7464c50914ac2936e12ec2d657950a06fcc9b8704b218d9" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="c1d9b15ab64ee7f305387e4751d584ad47e0ab558d28809116365da8d10d1c35" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="aee042b56de8042ee566cb2127582f9c7c79e0f691476254ee33204ff577cc07" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="ccf0511e7203582524362f29756631135c2fbc4a667da8ca75f2b35af08540ab" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="f8c472ee778c7f0c0294fdca6c39418d17b1246c7efee93f6bf2e70aa69e8020" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="abfb1321aab0b158a1da813a67af7446cb1a1d2d9d81bdb5e791a32e80356fa7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="398c4652abc88d07b9576c29e18f740ceea20b49cc949195f21620a461ab68be" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="2b44b9dc35118f57fe3bf934df5204d9bf67fd04bf44a66dd2c542a26e534893" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="8cac07996b9f92134e18dc04a456ab90170df74c3454f8f3eb1837056dabbb03" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="d3fb5d7c4ba43613a3d015506e99205a942e59d1e53348cf49e4451640bfef5d" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="ab92cd9de9e9bf83dfca5323c37faea16b338cf341bd92ad21545b762132a66e" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="be79f0f240c76cbc1abaf6b6a8a0253d0498322a0368f1463f71993ad30f37c0" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="6a3e4266c4735c4f35fa5cabf1b008550fe7aa4136c886e35fd30ffe6c994942" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="060db4f1566cd79d135eb365d824bd4014b811375a9de6612e12beec8351246c" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="aa178102615edfb883ae4bac666db4859c62f60c44630aec20ffc6b8edfdae33" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="c569d57e01a18177d721c12c53e1ba992ecb25a2b72f795425ced593c30eefe8" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="19c82efa3eb5cd0cfcad7de2cba961c3ceb001725692a7eee4bb4663af50a50b" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="104b12fe1f80d08d9eb0f713818e49dae606053ca45cd93e3f676304665789b8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="3e218451b538f5f2794a24c22ff23a7f2cf894846f3996c8f064a8a1c6e2b60a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="14437c20d44deb8e276036e5e19bc330216412380a96280585ead77f6298e59c" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="028665ee63551f8b7f8eaade95e9092ce0e1bbca4cc4993c327acbe221f4ecae" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="e1553d5ce58b53d14c5842c1fbf736b3b590751b2e3dabf3ea6378620297aaf6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="67fb48b7201a3eeb4ad798a27880bfd9fb5c624bf51d7f159d75ca7830458063" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="5ce7ca089bc26b2d7dfc51e3fd26cfdc64cb5340fa00ac19c260a293d3c05442" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="e6bd416036f6278d3d3d13a4cc3bc3aea6cf96cea1f3784129e500be239fdefe" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="c4f24cb94143fff17cbb7bb2ffa5dca9de40ad025e8f5e9dd47c2a5bd90fdf7c" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="5b84cac79cbaec680d7ecf71c93c5bd7be10b2224e56ec754946dc2f53388547" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="7963c4ee43e63ac24887489fd7ec0fa95d9995e17fefa12d9221b6cb7832f67c" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="a794a1725a8528e4181346a82eb06782bf260eba48a862278b4a731428dcbae9" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="827c1bab62fa3a3e359e85be78ad566b144b1b130c1781ab1d3b7bbf589473e7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="1bacffa8019462a66de7bb1ce0c8619d831108b21db50346062f0bc30697858f" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="7ffd8f756c18b7ae98d9413117a46d4a7f518e0fb6bbaef68b51c25ababf6363" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="cdbbaefcc2bd77f9c2076a565c2cc4660b1634156f027298054aba2216e262b1" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="7356d873eea948973303566488c995fb03878d7c0d2439f75845178033c4fcbc" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="8dc2f10c987d048e7fa9e096ca58044b090d0834fea2f5259316e109b40758fd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="2151e91b8ce0ae209472bd53d0e61337a62a52149878c384807cd15f017f0a38" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="8cef56d6e87600a44e8733046973d4a435af08a725026a55fcaf02773d837b1a" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="6384f7f7a95d38db22b4e0befd15b344c8540d9748762d71436c3723bc2f33a8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="7819718cc66b80527e82178fba4b762ed7eec6fe7ec41e5a883dfd70f74d28a8" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="16588a3b210662046225f0732d93d3d9520cfa0274b9d93b68c5e75153ac6f8f" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="47d4fb3e4126d7b3f5b6daca7203780e7084ca31363fec167801178b1e12b6f7" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="6352a1742a5f61a718fdb7634a4c72a770087208bc136285d0f9e014f30d9a51" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="9ee170458f5217b1872868edefc1e538ae614d510db0aad9acb0494327297afd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="9160359a699df05f6be0e73efd5847bfa5c7b849842cbc268e6f28270fb08daa" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="77f96d024f93713abe8840e41f60ac9ff5e80f5fa23d15ca8b3a7e48c4908545" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="a92d5ac2405d8744fc5e7c89d75273e00ba7762f183f4316f7304f86a251a04d" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="2a64905389a63f10995ec4f87b9399022337b155121274fd585b986f65b18102" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="c1cea6d1c4259d1228c1cab8502511e5a8c596cee6cd76928b8d2a09a970f959" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="9356b036c7b23d9ba204589e74a1d412919f618932ab5deb11f9a1bbb5bea15b" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="7994712b37160de1e670045f8fbf92d4b59a1e09d37a871088db50d19bd7dda9" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="ad6f0781f27e172e8cba782497ea4094233e770788f0365165bf7456f5bf02ec" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="ac23bf8ae7628214f63acf1fe42592fe5c9ffefb41f51dff3b8657f1c1f9529e" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="6e4fd1ac50b6839773d8c53ed4c4e3d83e422b03bcf23c32632acf9c84db795b" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="c4a30bb835049cd2d2d0fe650accfb2fe14bd63e7093da9f0e08d4c9d1260741" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="208ad7b09d8722299362e98ae4e42a67241b4407c0e95a125e0d022b4847b5be" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="26a3118f6a60cdd5c2dcfafe6339f8a3fb50e5a8e719f3fdcd10a6066654f780" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="ef66a342260af0b83293a7b66bc64f3d0d203d927557b9075b3bed6feb008153" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="dbc4b01ac46a4a209bf493095dc1e28539f8ca9525f4e8f8117e6d5c5c63b9ca" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="e3ca145ac9142966de93e88806f137a7caac8f4fea19ab42eef6d0e8200aa681" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="3f7d299216f774062e6b2ef67df948d1429c16b185f5b655ef336562f1319bb9" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="2b4563bcea97fd4b6a6b0ae045e747e048fd2d4507c8f5ed9836ab98fd004bf2" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="e02033d54d49931da681bbaa14d441c9910a2103d02155ac72302f6ee79d795e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="9b7930573dff00906f8e6407eec985e79612ae8f5963649bdb48829cd23c7dc1" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="cbd496448c3988e7b687f25ee94954126de88e616e9685352dd9304c60916384" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="a43f7de9a097d94f1e3d912a9cefe039b004b8073707f20df364579ad1d87d7c" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="b7ca9498e4339327c00566e75fb56f626bfde2c6307c35aa9565b30dc8771229" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="d2d2651e71bb768da2c7ca9f95b563472b6a9fda0a2fbf523b5112ddd3ade0cf" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="87fa795ea1840bb19287f114c64df25513c887e5e41d3e62157664ccc76b3cc0" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="a28e3dc17308266ba6088eda9f4488c98cb7efba80f1b095154712a7985fba8b" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="9b763604d1c4591d50644fd739256b42136b26e8ca0e9855a2780359fedb4681" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="b41ef097706c090f63781afd4f0dc723e202a4584eea5c5166240009123e9b9c" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="93bbcdaa84712faf9b35d0bc9960232a8337f2cb69448e48a7371638294a6aa7" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="0c88ec37c428bcca59bcce05b118c7135faf500d61300a4eb977da089d46fb59" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="4e90c79a02ef59fde60c44d899aec7fe00860bac1db8de6cb18d93ff524fdfbd" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="3ab7edaee54f7d87fe52c60f31861923ee2928816f75af8623c652847edbecd7" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="d623d6c14de87a3e06286c2eb825e11fd558a8493a64cb9146c8d117fda8ba69" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="d3c93550e975bf87965a1c0cd9650bbb86d2134deeb0ecc10674f94ee60bca32" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="5dd843a42f18a6354e8d3a0eebd049a0a93f2d4e5c5085468b6c556ec9d11614" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="23063de409a7d2f4356592263e4e5333233dd374d5bd39b741a8644e7f4f95d9" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="6b5cba48c1a9e6c9c8dcd5fd587744be2488f1360c81ae5b7f57a4d994aeea85" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="7d9d9eb3ea09d5abf755901f7107d05b45f4286630d63fb039223b5667f5c758" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="1e7c072330f30d67dd2c984ef56f68dae01a4858153a42f7fec32ec03026878d" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="767cdca8ad1e28ea1837ffa42902f2188bbd73d31e852bbf06d0602647102542" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="75269154c7e046223d5834d0d43524117c2dcb5704e8ab2fa1d22eaa754c65ac" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="99a67d7f39ff25517361c23cc68cf9b3314976cae517e7e257d9d591c1f07207" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="66d4fede02a2d0f20fde9b773a33bcd9626af4c5ac40edd39df5acebce938f78" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e007a6ae0ebef7f0a662192af5e7d51ea7282533675e79fd9713d433c4ba371b" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="42af0b2a4b0ff4928ddd78a20195c0ce8d097fda76a4ffbc9455237535fd7fe1" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="d524576ff92302353824a2d076b945db564f0b87110233701de2b59d36410d7e" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="4f7013974bc582914660d76f7f4cfc1ba8b9adca8de6fa8f573bd235b8451577" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="ba6a1f79d68c2ffafe0add6897f1bb19a7d80ec8ca16e99acdb5974beafc98c3" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="924f03e0215f2f2e89a501bc2a5e61bff92b4e1a3dbff020e20fe5e1e64ff8f0" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="c554b25adb0f67e274f526208d8695dbcf4991bc8373c6b3d8e23b5a64d88743" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="17522885f2b33d939cd552b5e79e79f1ac25d6d3679ac06c2f01a6057671b27e" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="b9e5c24578449aed797a597304de59763848769c6e491beddb4deaee4138aa66" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="7e76df58d650db2eb485f1b4a5a89c92da27411de4dffde2277907433c1d224b" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="33706794af6967169214c49c2b3ec8a1bd55cdf3698de50cd84880757ef1a8e6" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="9a7aa2cb1ee03a0e145a191533a23a55f075184e010e485dd6241ca833a64b05" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="41178f1c04611e814c2f366fdff824123aab1c7db1d38506c6c46df3be3aa908" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="4a82ea80768880b99b1a5007efdfb0b01bdc909f054c5b677276d6d54f2d8855" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="386771a9951007097958833b61d7e9744fcc5c089d69c82166f4f3c42e5eef92" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="33a8815dba0217eb2bfd91e2c18e2cadd95434bc7bbdb45c3680171431d4fbea" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="ee25ae339ee900fb3be6b1a077cd58a9a9967487fb1511097e962c60f379e31e" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="db142ff5f5893804140b209c7446b435e762d20f70c581ec0af1340f2fc462f5" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="6c0768c5b3e0790dff43f1c8338949d408d07a5d6d268cdbc53206df3ae78a69" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="07ad057a03440e17a8cc9f617aa7bb01fee0b8eb7fea22bf39f98a6c0225708d" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="cc1beeb7f304ee25f9cccfd2dfff225447428adc5725146418bae154fc116b74" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="37fe79c3b367e195a59ac524fd68e6177fc4ef24e2e2f0977ef2f2ffde4690fd" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="f771496df4ff91c03befc86afd4c2e8b754c2845d7f6bfae3ecf53cb020a7aea" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="404cebf2500b6be4dc23ac35c2952e6114fdd73fdd369e2be23dd3b2fbce7c16" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="690885d30cc2b3035de3e724c2e9273f1230682603b455e25d5a5fa538f81986" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="7536a1f4a62172d824bc96023071eb6e59250f945485e007aed7b58f69de9b1f" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="989a862b8d02941c8220663c5ccc9ba81a7ad07f35a2805de32130528d2da5d4" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="1588c2c06d4fc7797150e21db1c89cfe1fecac634f173065bf43e88a0da2dbb1" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ee27f558595a8a6ea577c81f13a99d06a18c1dfbf613b90afd4ec5511b4307a8" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="7e400cda7d73fe6f8d46f16cdcdec84e76b3149a7643a0dae247390e24c9983e" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="699820ea3e730843a1f4c4361fd63c3fddec9c42d664b2b59befe36eb34111db" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="8e40a855bb16f08c8b3628c31ec13779131868416353b73b2802351e055ff4b6" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="c1eda57c98d60124a1089516975dfa669db09b8c0a1bf9721347b30a1fa95e98" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="2f4f471b7342ad68306f103cc7377fed86c47acdb3e7efa71feeb8cfc2a94928" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="ef1ca392c2f076b96630013dc44f663776fe57ca6147e76d84f403559b35c1bb" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="c69671bc7fd495cada7bdfa4b0fc419de0206a08e3ae784bbd85b13e703177da" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="3a6405c372105385bc9e5881e5d7e0caf214d6007f1385960b14c2b03fabf32d" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="c8ac5a891c333e875ab4dbc27ecfe512b2daa24e99338c6aaf1ff5a36be58af4" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="9cab3db792dddf39dc0798789a31af45ea29bb651ba078bc11ce1a4ee2a5a9f4" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="965145e1a924cdd4a2481ab28848e5677e0b4dfbe7874c9a253781bc5fd77297" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="d16e3447a900b88f8c49536bdb41bdb8039ed0d17f0e02c55c00af7eaca7de68" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="165e9a5f850a94e7d31dcb1593e93394e6eb7c6a0ceaa076bfe2acbd79587647" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="63d7a49777c5ad3ea2ad5161f208ddbd028c908971e6639dc07e73b216e76dc4" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="00a630826c953d59692d37de6eeb0e7907ec29cb0261540741bc6be4d95df4b0" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="d98d66dd6381ef63cff71b60bab19a5ab8c2d34e41f32ddca4d555a0a85f2037" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="e5b3d9d285f437078ecab782d3640ffaef327ed4f5c666abe43f608421062848" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="03209ec675f64858600329b32a0a011c1d36e461add35285a0ff90b905fbc576" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="345233c56f5c3ead4640c26d571806e20147dec8dc939e65fed9a368d8971b6b" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="6171e28c81e0d1c6922123b387521230bfcea3a17ef8a61a796eb11d734f8d0d" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="204b92bed3605c9baa9431a74d67b0fa18826b5d0d0ba03fde452c82219efd75" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="353c75a120cb3db44145f36d991e7aa2efec208fb7f60c3180cbed11cc54b449" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="a49fddcaaa95fc0065e187f76246cae7f554a4a401bb28d6328c1743b7bfabb9" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="88931374210273bcc2cb5dc8fe82e67ca03d7f09fc3520e1a9e9425548c910b1" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="5d2d279e5aad54d8d3ca36065f2d1ab365a40dfee770ce99a8bb28076f89eee4" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="903a3116242df8502ca498861a2ddc9c3ab9ea69256658cb608ec0318ef8f228" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="4128e23b5337fbd7e61a8572a9abcf2e28edfe23fd4c84620141944236369ec8" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="7dcd7dc8d8ff92366ca05000cb8c5d7b4c69bf6fdc6725beae22b32a6f6f2f24" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="12db1029aa87918813e5f1802c6220b6824ebdd7d5853099af6cf272857832e2" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="13545056bb54b8656f6ff404309c99d1365222deb438ad8ba2e9b069fe9e47bc" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="660a7d32482a094e3222cb9c9984966fa7b13117dcd1c7ce7d70776fd3edde32" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="366c35222bdf7f2b07dbd9b1c04d6adec8f1cbf502bf8a13d74edb044c28f90f" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="4a86773ff8a63f80d1315991f185df70877f4a317854497b1453f93ecead4d78" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="4f456a152eb266a3f1488307323faa870f955288d7616dbc7a9d2078269c6290" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="508ef2b98956a88739c037512562a68dea81aa2d99b29aba8b6c478fcd003c1b" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="506fdf99460460cac0da1a6db5b592f6fa3dc02921a196b4e9fd524c9bb35253" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="2f645b58fd23a168c0d965d61e11d359c79fd0466bcd1d6e9bb61be6c62e4022" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="f240a920c58e7920972c37ef9bac20b42dd8ba64837a7cc9bd8cdf0d4442cdfb" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="f07788d1422b3b0d34932f46bcf8f5b0bb720ae93f346f33aadf87a482873a84" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="9f3e7e7542889e45d94d3ba4621180a5c65ff393bb345abdb46c68d2c59daf8c" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="8da4d83a925b95a7235abd423aa00e1370498fa0167bfcdbb5f9892746489f16" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="fb384ec9e5c7518db310f233387bd48134735c000dcc27a96f1c5c5b7ebe3051" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="1d8d9efb54ba2d2b3e3a13f34eac79e8135be7c0b83eee5d85ae4527e84c61ab" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="03d14e0d6f4f59d0bd4ef9bb7d18dc3ecbb7a43617a285519b20ca0c3c74e201" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="5b733ded3bda91704a3abd55c81fb1beb9316f0900e34f1394422f5473e63fc9" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="3119f89d310b1ac81d8b06dd7882e8dfec95734b15c018a9358ae59652e34b01" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="1c217397ae3a8583488c81989a1bb9e90db1a37362712f7d806a5a0c8f2523ab" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="080ae349cec27674c9e31fe7f1da87e2cb0b296fa6ecb4cf72cb65bfac239e6f" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="e558eaecb4461511c33ba0e072c9f80f09955babfc79f359ee62fe7c6c5e4e60" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="f346f26a36d984096423c6eac728dee6a75dc56a8619d75b1618bb3d50e67b88" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="aaa5a73b3116ee87c8cb4340808724a3feffb6eb20182744eabce8d5ee3bd3d6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="4fb4875bbed0d247c69eeaf0b6c2506db26b8332cb62288e6577cd208a4551c7" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="ed31f95f8a13db05037baf7380e06b894bc5df28c8bdfaf7f188e5d715ce9f38" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="08723d53eedddaacb2a073df890f7dcb47b8da2fa61e3e6cafae73cd678cd386" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="8b2915fe3a22395e2e96675004051e42c1f3170b6b766ce2636e5aec91c79396" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="5ecce38e0c43d95d2ca6ad8bef5338da0a57e9dd314ca21ca2bc86e229535df9" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="dbf725d4c857fc12063af18b11ce3213a6f5ca6e86e4adfa1a57a6789a94a15b" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="50b1fd6da068af1b74251d07884bb76b3cb53ad3832a1ad02a5d1796e627555e" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="465ba647b6786af27bf78c10ca4a5af519497f2091174186f651d867947c9bd7" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="7fb2176d883c63a990f0de46c37d7a1902da82dd99ad026c0e0b7f1491ba78b8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="219581665a0117e5a84f1ef90a6082d1790bc016e2f2b6bde835bbd0d821be9b" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="468d45bb34114c1a1fd6a3d17394e3a846a1f08e8adf823ed78df474fa59d436" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="34324bceba15dff47b43585fb30c8e94670963c901faa82b208a10abb8baa09c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="8eabf53d400da2816a823a3b7d2b8d14263dafe2c0636ad5097d79f5c82469d5" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="0f984634ed3051e07ce7aad641492f20d9da953004b602d770987fbb2e98e092" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="cb6b566f168c3af99c52e99b95694aabfb36ddb0c952dcfe6fd28e98d66ee6bd" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="dccaac6c8b290b6b611ff9bc1245ea2e64ab0e445214a9a77c5443ca6ee51efb" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="b8eb9c3de6bd3dd8393512add758eed1af26b4f56a116063bdf0c7f6f9178c3f" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="581462dd6e26a826652dfb985c28f7d7b9b93a95d056de77e45f6ef46f49096a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="6b17fb2ffb02c32a1e3c3726bc2d1d86d3e6948d9d8de6ceeeb66cf527c079fc" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="a960c8ea53967d59e90a36e5ea499436204a7c83226f7757cc0151f0f3873c1f" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="4179cc6c1bb6d57f3f310c9a533dd68fcea2febef1eb8e39df666c954c442a4c" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="bbfd27c5f64f426e049536a308980b8c3c5e52774ad0042fa95a5b9dd0e0aa18" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="212fa6d02b347b2f0bcc567facd23dc13c902126ad9c773090e3aadbf11ac34d" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="fdb66ac31679ad2cece52826a8b80c340a7a00e0edfb3e2621496baee8d0ea6e" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="195e14bf2554907e7621ad883bbea5f8fb347225b066ab55c8531bf319a24f1f" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="62824bb63ce595e9f644d4f336a1f085b2b4f7bdb91ea545e41b44cda76c50ce" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="42739d955784dd2ed8691ade85a52bfe047bace91ad318ec8a9df9e3e37fee85" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="e675d597349d0d74ae6e68cd0b58d3b396fccedb0dbcf5bdddec6097530439ae" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="875a3fcbf451151abe491c613efcbd3a57be6e29712a165d1a81118255e80850" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="401eca9def0ab5857ac03c4919c682b3061a975781a5b73eec887b71cc3843a4" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="bc5c983e1968218f34ad04b12fbf85b5cdc10025c7c3ad391ca7fba2385c708f" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="21c74852d4f63c053aaab94de7c810910619950b0beaa3e02728842a4f0bc13b" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="2cbea4a2a662a27bc0f108adb6b9b7c251c1f7c666f0003d925403a4b0a8e5e9" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="4090991a81f60146bb3cb9394b69f066d220fac9d8741a4b9e141abd0ab5eabd" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="a423c75bf985210c71525d0aa6a6597a247529d9d8ed4a059327cbd2623832e7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="6ae0605d2fd22034d6b91007ac37ee14e3a90d2c45811bc4a9c1e8efa917be20" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="96f91e181d595f2a581785eede5bb7007ebaa609a6c3caa03170e315ee50b535" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ae69133e0b08b2b58b6e4ff0c7bc05c55ce280fdf09381fedf3b03dce745cf3a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ba198f074b9d4ab3a14daae0fb7df02a64b05f3eae4647ad8b89907ab27d8657" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="01e7026c5856f9cb2659fae2a8a9c0d34f7326d9299aaf5dee61b2fbaa9befd6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="fbece1125c3f3a793019a8be5d456edbddf023ea5051d93280e2bb452bec186d" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="18378a3573bd3344a572bb0296fcafae35da9170b8a21dae29ecdb2302f1a41f" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="e13dcd154c2dc0d23f15346ab9b3db3e854c3de41cbc5a03a43d3ce436e8e1b6" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="688f8561302963cff07c615fb4c7c8a44ab4368b76f7b72bdd23c4dc836978fb" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="290f32a595f7e4478e90d17415029f525ec4fa71235904aaa3e5b2bb037a3bf0" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="9b4ab2cd13a67eaab3a781d364618145398011b523392cc92b76d2fec86c337c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="f02999a092cf379e5248eb3741de56c50d8c7ba419de4425b83fd876908daadf" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="dc231d2a2ca8506937c4e23605d3afc11c62f98ae0b37bcc3642d88243c5484c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="2524f30be569962a82bd93e48d4bec82b611a45a49752608723d231418530e87" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="d62de217555ca23e194f52ead6df1be95c16539a8da033c5631c1588b752b805" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="10e9cc518610f9259cd578e2fa27ebd1384d6fc40b25340cdc9f17b429066e60" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="65c0d8d3fe1ad3521da415c3abae03510aaed0777fa8b9270197537ac3895304" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="efc72d8f3e4a3088cd7571bb5b3243ad4f862dfc730fb3432a753c3d2e31ee26" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="8c5c520e61734cff477b73c9db99ff5a525762927244a97a4d4619e5113b8a4f" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="d2a09226232c0860989d6ac7b11ec22e904f8c3be5cac5faed6f5308a98acdb9" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="06d989e33f06a66ef17dbbb80890d3dc9bdd9e4d28a0e4e50f98491fabe51ac1" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="9fb816223b192ac53243eb300b0fe7a3687585d7396492938c18f65b60f574e8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="b8af29058fa0065c941d236a85653efeb90ffde5135babf93ecfa5e2026fa187" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="2dbd2a51f0d074542be635a6e472770e1188eb68345cad9758ab75b28e032048" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="252fc7d50a21d301e26764d73033bffad30e156d5d785b12ce7a99d6f1958274" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="56029f098a7b9ff0c1f77dd6902c74f9f5acba513c0f63e95ac555782d0e78d4" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="ce97f61a4a3b622ecc3f913c2327888618c9b03148ffdd4cd698477ef7536999" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="5f4f147c683ada544f91a183e09ea716b7617a22ad7fd3c40541264ccf98f06f" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="5d6fb46a909e00b3c66599899a4da0e2dbcc46c662302fbf0da41ffa20cbbcfb" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="5656d7313edc9f35c651027fbf6d1c1c13da966d619f52f544b5681d40190b82" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="d2744bfab861f9c9fb852ddf594045beb92bb54f0dfe6a0ed655ec7c5e72c93b" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="d9a9d0686f4aa72149fa8c5fff8b4bfdd281bd250907b294290b7e1229512db4" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="25fab9b9d91c92324e0afd26b7d677bf25a444efeb70d11fb83b3cfa2c9a77d6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="9346e2d5147074b846348dffe4dc34bdf170123a7fdd6cf3bdeaa3e07767fa18" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="92589dcd8118e8e4d63c29a553a3316dc390da75da159cef129236de098081bc" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="e9dba830e59799fd282daa328fe94f8445a834199ebe926140862cff4b001a05" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="b56249344aae017fde2d5665165077100d3ed093991f2c823e14e9b0ceeaeb23" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="728d6b4b7a4b24c636e2d556c4b68ec60a747fd21b6350456c2c794a24fe952f" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="2645a0a6bedca220be2ede640006cbdc10705fe41a2f01839d4ff9dfc3f43b59" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="e6d518cbe6f51520a4d4597438d8f318f71ec4fba9510a69cc35eccbd9f53cfd" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="10a717047f3bab9044a20be59a12c95987580c0f5344518ebeb40999e133adf2" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="0097c3e9fad4666effb0b7e11f21b22b3b0b9d0e08dd3b5753de62625979d152" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="9d8bb04687490a1ad30bd9ea9fadc378458b08c4f9d418cce07bf562dd4fd1b4" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="20a151efc6d1a7a788d8a772265e0d56ca2f1943688a398f345c6889961113d7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="d125c236293c2eb72dd802602cd4e441a54d83afd4a52bf6d1db3d66c551463f" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="a818438eced3914650201d4247057733ec7a90795bf97c87e9ae45b4882c623d" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="6c4aacb3329aa186d335b1558c820d50c716ddf66a970391f92dfa5387607311" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="f948d85315fe0706064521c4747dbeb8fbb55b83841dc09b0a687a2c25700041" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="12622fc71b48b4fa7f8e260647dd2b40e0b78030a16f208e6deb51ac5d5a0a88" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="60fb4ce8980c4af3c448771eae73dd1fede7a1ab23d54fc679cd6c81f7b3c8c2" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="3f064a7d669c367e84ce119f35763390b2e5d40ec8ac5313df581e07b9ba66bd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="04d886c27ac5ffce72e1ac6e1c7e00ff312655d1cc31d6ded5a26ff683138b8f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="a75acaf5bc855f7cc8984a6ac2d171f86a5422b75de14228bd385b5110253fd5" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="102.3.0" rel="150200.152.61.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch and mozilla-bmo1602730.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox 102.3.0esr ESR
  Placeholder changelog-entry (bsc#1203477)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
</package>
<package pkgid="45da587741c1da9ae935ec55ff881dbe63491d5470f0dc1aedb96509e828a374" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="ebc515c34d04d552aab5c218fcec39be90be8b5ccc66e8d3e39e23e15d294088" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="fc9424feb3dbf6f64e3dd1299b0a57a6a800cbbabfe66a3d486b178b035f4bd2" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="c81ad28819f7669703bb8c7d6649f09dfefb880932286c90eea930abbdf9f47a" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.152.64.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox 102.4.0esr ESR
  Placeholder changelog-entry (bsc#1204421)
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
</package>
<package pkgid="c65ffcbde3099679ad0c001972d66699f412c963338d04e9667ebba4010f558e" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="5ada9580b350ab30c9992fb0e546420cfc1bf9db85e32cfdda02d172d43a8fcd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="593474e98f89e94c71ededed4a052ea6a6ebebf9f2fbe7faa79188b8384ae535" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="53b4ec752390458a3c61ffe88ac0ccb43f6459c46c8b2a3bee2bae0631b5498b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.152.67.3"/>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  Placeholder changelog-entry (bsc#1205270)</changelog>
</package>
<package pkgid="f44ff2c3ee6db5772a77219a3eeccd634c40f3bbdcc2e292f60f8d71cdf7034a" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="80d04c7a0abb7734fc7cf3a36e785ed142388fa25c0a420c19e42952cac82a76" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="3d3d13ed5d7ad6ded96cf33f6dfc0da770547886e09d77d531801e1a1d7d34f0" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="5ca80937117bc2b5f5ae29ffba793bc05812719f537a9f963b8b4d8beeadb9b2" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.152.70.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they?ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat?
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won?t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we?ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice?however, if you prefer a bit of notice,
    you?ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox?a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries?is now enabled on all platforms.
  - We?ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We?ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We?ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We?ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won?t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they?ll be
    saved in your preferred download folder, or you?ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They?ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search?with or without
    diacritics?in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field?s context menu.
  - HDR video is now supported in Firefox on Mac?starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on?just make sure battery preferences are NOT set to
    ?optimize video streaming while on battery?.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies?including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin?for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  Placeholder changelog-entry (bsc#1206242)</changelog>
</package>
<package pkgid="dcae16ab18d68314b50e66f9f8f4e4c8ce12026edde734b5ec37d1f10465d190" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="6c605ea88a086a0a722dde5391c3bf6c95dec2f78935a3efe91b6e50d22e90a8" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="2ef7de6341a7edb0950f77bdd43e60297682bd5f1c13d31bf41f279d6bff9980" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b064724f52fea1bf907e4e7ef5f943a2c1803b3e71ef800fd9124f2094123092" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="84f26426cef4e0af5b276b8abb2ade2e844621d01a2c4e3cf2c28afe286f1de3" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="8ee82eadedf27f20585a99eaae3e853f73c4ee4236cf93b21597d8146f6f1e66" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="911a1fa31009555d5c05dea4c0cd011031c8c1b68cfe371b8006e4414d1c63be" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="125622ff958eab1cfa583304777a5dc62bb5106a2643fa58d7152a2431764975" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="f01e573a8c037d17109761ccf8691c8cee4bb4e9a3c35a26c9760ffcfe6e1a80" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="d17aa0432bbd1abef9330794377ef4134872412965aa19f355d0e410b5f2dd2d" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="01fa03cb97d2a16c6d47dfcc7117818b889332840c531e9075489461aa3d0d97" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="867a8c117374d2ac17d7181687658e9b9ea23adaaeff5b4e00bbe7096d056a93" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="fc70176de752eaf4d0b4a5e49b622e0d38637e23c4a4355b78a88ffc691c2b28" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="26a985e2820a83f31b5e209d8642b37f9190be1ea286461245e970e28c4b3fe5" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="1e12dd81101197e95beb2767fea28be433ed089117b04575884a4664c82beeda" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="6d02ab5a8b50798cc30d9dd356335f87ca5e575a89329e4bea8ac8c084236050" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.152.43.1"/>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
</package>
<package pkgid="b3ea50234013298e1eb7c1dd5bdc05556a1d8b626d706b833eddb238f8245f8a" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="7d573ae3411e63511895fbcd2a29e92c7b6e7eb3f1956fe35cdf51ef87c98ce7" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="388d7a4c76408cb79df434f159a6baffe7cdcae9ca11693f9524ad62030c26c9" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="95198807b73907c035d3434d141dc4d4011a19c76802a5db6f90a204357ecd1e" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.152.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
</package>
<package pkgid="15b748ba6b3de43bd9c6764f26628aaa7b9c4df2508848d0120fa45a2be3929d" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="c5a553cad896c9e48a5bf178f96b59861b2aad4305a490734c034271751a8676" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="6cf6bf43f04094de1278ceef7788d7e8c49e318244aab2384142fcdcfd087759" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="c6be12e5d304f09cf10dc16896530a5893400ceed8d11385367cdf4f4e410400" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.152.53.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="2b6524a4a50574620b553bf5820ca87f4785d836a923be77df518603d0dee863" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="01529c70073933ab22a14853fc19ee092f2f443262aad847990e1e03816134bf" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="0a0f59855ffc0e5be6525cc82e34ffd4e58d10553a0ee081812aae4d4fb40c3a" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="51f29270ca1b63c409eb5ca1841baaad3cdaca9c2fcb9831a6371a909f35a4b8" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.13.0" rel="150200.152.56.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
</package>
<package pkgid="cb3d8ed64e1116a5be76fc30c779a1cfb51f2d660731f03a0af6f8261f49c075" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="3e611f4bfb866c6a459f436333fc2cc4501b4a9be7a11d0547b992a12458c9f0" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="a97a59d89577548fa28fa16ad26eff6332158fce3134ec64578f7dff66ba65bc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="c2b07ca642cca27e3637b7ec0f81b33a76a0e1af34691cbbaed8da7aa72bcf04" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="72ead71031a04562677febcc81034faa0dcb5c2f7112b3e70f3a370a1021cac6" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="ebb747ad2ad9b142de4b4d82610e0419bb57851888825b8ac4ba35270e6c1e7f" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="8585ec76bd697834baf0b9dba1be1070665b57186aa6937ddf022686c35413dc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="19aacedf0fa430ee8c0a6f298bb80fece49ab6ccdc63458cca00ff42d90aba37" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="ccb898f7719ca2793733b6203e0d1c8c947981423e471e57976d1371f5b05c4b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="511e2e2ddeb28bed44875b4f1518d256fb3f5f58f5ba2e0d2d6e0680252ba286" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="ea2bdf900cbb9f9cd69509bb34afa3e90d4cd9cbab0f173737d01a49a7174a04" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="83dc05d0099d57a14d22250e22069661f2b9b657afb7bbfc21f5db35b6fcab12" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.3.0" rel="152.6.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
</package>
<package pkgid="ec8d2174694c436149650d77d04f5d4e16d2874e4d971b5af7d7b6e6e133c440" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="d1ef5bdccc8cdc15bce36ab6cda9f8cba245a19e6178646bc63a6921e74b80d8" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="c093c226c72321715d7a4f5675dc6d320dede8c0327b41c1075a0f10c1503736" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="807dea9459f193b5f57de7b015d755c853c9aca8e84bf7e215638122761b65ef" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="152.9.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
</package>
<package pkgid="b3e3d170090872b94d08da6a7e28e5ae576c67a27fb373b655e828db6adeeaeb" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="d890d61b278b27089731ef6539b557782b4d5d0095afc68c3cc996f11e1753bf" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="2fa898d82b47687725a40e7af82d06d1afcd0413117e93a0cfab72782eb90c05" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="947243b93489b1a813e8077062f9658f90c6d14c73735e6c8f4acdb4f6bafa8a" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="152.12.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="b81b2f6301c4aca481e1d34f889eb0a65648b61c66b20ac358ab822f12ecad1e" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="34cbb494eff5a1bb43fe5766a7aeff9f10d24cde6896993f36fb8b0496f37b00" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="aac0c75833c58069630666c85fbc4d892ed0651a967134fa55a20d8b6d78936c" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="678fcfba354fca83c8bcd68ead9b614064fe46b4bacd54d0b529173196c22714" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.0" rel="152.15.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
</package>
<package pkgid="072417021cd576d9f3c2bf5916a56fc9c6514f23e8b956d71c3eb62e3ebd14b6" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="55b26c19bd28cc8c472ac0a9de52ffde49b80bac052165cf8e2471260be911fa" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="0dce67de897c69e6e5fa31ee05aa73dd9c2d863882556deca30a020e27f18d6b" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="f686b1e421d418ea26d913ea35912066819e1029833146c160aa4140c1b3566e" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="152.19.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="f15943117deada5bbdeef3fa01cc8d0d3cf52b40cddd82127821409238f970d1" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="a84abb87fe68e198d962298290a26d6dd02d5729d78b7695ad78640f77bd9176" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="ba0db8147a913c6e839f887f2e961f0bf1a4289f9db15a0d7d371ae95f6305b4" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="6cff4392dc066e749ae6ad539092fce82c665043cf22d4ec3bff658c35b75e75" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="152.22.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="d1c4a6557315843f2861375f669bf4a361a6c1a6d4f61cbff5a3ef8436e3dda8" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="dd3fe5272b1745655d88ca17412aff3c131bf686d3d05513f6787f47785a31de" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="b40b143256b14f3b7f55c0a6ae4ce561f7c9c04f85d34892b150c3726a33b6bc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="aaf6a79c9b5095abd8d354e5b1bde882a62d62521fc1c5906b313e01db56956b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.152.26.1"/>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Firefox Extended Support Release 91.8.0 ESR (bsc#1197903)
  Release candidate! Details filled in later, once it has been released</changelog>
</package>
<package pkgid="85a11133a31f885d3557cf2fed57843e24e1945b16cf6fe0ee984342919d87b9" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="a291b9f3444c7593bce50f0cf93010401254556c44b280c0a0c47c0729c92936" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="dc554e664b5041204ae7f0ec77c2763803b6b3b99c6085ed71ee2a1f1273a05e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="c00f995d44cd158640c12157670c1afe1b22414062991897c5a6e24ab928df8a" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.33.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="873a0b008fb6ad0ecefdea04e979b91946e90f3610e1dfb2a47cd10979d05559" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="c9eef35f241a7d601eaec316553a4167f8ae248a8550d1c3bfb146e46a865454" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="53f85ec15620281a17a6577182493c2b59a4813e7a88469beb171db99cc03b64" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="f56e1b6d90e374f777ed46b7704a13bcfcdb403bf12bedc65c59c2468586d68f" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.152.37.3"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060801">- Firefox Extended Support Release 91.9.0 ESR
  * Changelog placeholder. Details will be filled in, once released
    (bsc#1198970)</changelog>
</package>
<package pkgid="7122bf01abf8e89a91489f6f5d3de6ba5f2284978396a4b26062ae820f261c56" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="cb6d665e1dd897afff129413c4321015d5172b4fbe19192631f4ee9b5379f543" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="54ec5651d4588917a94ee2976ab5ff46944089916290cf927a5e9dce69f4d512" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="d80ae2c748c7c4ee8064709118823f83230efb3fcd30f4e2f62001af6c0c7abb" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.9.1" rel="150200.152.40.1"/>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1635854400">- Firefox Extended Support Release 91.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-49 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Firefox could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
- Removed mozilla-bmo1735309.patch which is now upstream</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1638446400">- remove x-scheme-handler/ftp from MozillaFirefox.desktop boo#1193321</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638878400">- Firefox Extended Support Release 91.4.0 ESR
  * Fixed: Various security fixes
- Mozilla Firefox ESR 91.4.0
  MFSA 2021-53 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Firefox Extended Support Release 91.4.1 ESR (bsc#1193845)
  * Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING
    error messages when trying to connect to various microsoft.com
    domains (bmo#1745600)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641902400">- Firefox Extended Support Release 91.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1643284800">- Firefox Extended Support Release 91.5.1 ESR (bsc#1195230)
  * Fixed: Fixed an issue that allowed unexpected data to be
    submitted in some of our search telemetry (bmo#1752317)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644321600">- Firefox Extended Support Release 91.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-05 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6</changelog>
  <changelog author="cgrobertson@suse.com" date="1646654400">- Firefox Extended Support Release 91.6.1 ESR
  * Fixed: Security fix
- Mozilla Firefox ESR 91.6.1
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646827200">- Firefox Extended Support Release 91.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647345600">- Firefox Extended Support Release 91.7.1 ESR
  * Changed: Yandex and Mail.ru have been removed as optional
    search providers in the drop-down search menu in Firefox.
    If you previously installed a customized version of Firefox
    with Yandex or Mail.ru, offered through partner distribution
    channels, this release removes those customizations,
    including add-ons and default bookmarks. Where applicable,
    your browser will revert back to default settings, as offered
    by Mozilla. All other releases of Firefox remain unaffected
    by the change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
</package>
<package pkgid="4ea91d8bd77b563394ad76100a456f333acf41ac08a119cbc9d8b60295457f9d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="b19cebfb465279fc8b7108818549c15a72670f00345319cf4e8a1266af645cd5" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="e32e1fffd519890922b70672895af33512ac67f6e38b080c8c827cf4bcea7b38" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="ff0664edf55bf5d61dd749049b960ebb142ec6baeeb80fd53e2e6737231521e5" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="1dbefe0a7b571ef9a3287267100be44323792c79ca3bf2fd9c5f9beb16cafc97" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="002bcbea5ca397d21c6b9cd29bf53acd62ddd292e971270400e3d2b22f9e5236" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="9ff156253f41c1d0d58b4230e75dbded60c55b358ff5847d7d88ae4a65667c3c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="a0bd796edc08915571353467f1d924845406c146638d5df92c867f83fdcf2817" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="207d8bb52df305fd7f2acc75336bb656fc46feb7ea6b961045c0745837780871" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="5ed6cb24cb2a8d211aeaa4a2318fc17cad03c290595d37744412670afa0815ec" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="c1da79d4abc3fcdd8fe06ff8548d685632132c2657c00a5d40f5659ba47c5962" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="d36594930ef4bab9bcbd2c4d0152d66c070bd3d79a9203a4e9346b173f8730bb" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="f8f4a763339a75cad40d49611dc3dcbd93538aea69d1a650ec65deeed8719dd8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="83a4e78e6416535fceba9a8ebab03d9a6bd79a0ea23c60c3244924132549b015" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="d7c5036388643f0c2a963f744e696d274a82cb1dee9323d2151b4945c21de48a" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="35053c3cf78f301694297a2169e17e245c6bdbb1af9442b262613e75b692b021" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="32c70301355b5768be00511992b7a43aed414ce70d8bcc828dfe21f1ee3f905b" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="9ec6f75e62489007fa1287668663255dc2c2009e89699b7c9e8f48d46b45fb14" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="1a16e60003450d17b092af578a2a49fb0fcd6ab4defc546c9715f97ad033f09f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="91d418d3b5464a116c6f802def49ec2e5c35fa5bef50d9683ddfa512a1b7101d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="76963d2580f129927167a4a537e47f964506fd11e2260a884f7f012b22594f85" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="5d4f60d712d1ecbd75ea62b3cb7a22b7211446ca81d53ed2c5687b98928e359e" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="3ce5338dceed369f6deb128679681dc831aa3380b16e813e4c55da45fc13aca8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="4cc8ab5637e82aad8f898bcea9c64cbd687c680b459671274a02c5127a7a07ad" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="cc403971902d646e1b21a9729db614e461244599034e6cf594c76f08f1a286c3" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="cee756064649749e887bd66b66d222043869ba89b9828013bfc4976418f7afb6" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="6f94d38d831817bb5e74e41b8ec64d129acf9007f073dbfc7029a36a1a1fba60" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="feeee8505c068e0f23034d3d9a4c4ccb1b8353456b7c279d47fb0d061fbd10e4" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="71cd5844e27c01a670403730b8867ce3b6437afb623f25ce5c3690d07c77987b" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="3d2967d79c889d521c89c60ff9a116116fba3b48bdce3e17612e2c6ad57de068" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="506e82734537e46473461e0a3af99ffa1d0da2ac3b34426bc3f8d807c37bcf9a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="c2fd129285f53c98b329907b167c1c52ead839819bb1479fac0fe81b0a1c5e0f" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="fe53ea33b5638f966d72d267daf82d48edf635bf95a7a38524467d3ef7d739b6" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="f26ffaffd86ee320197d397459525f41371af0c9a690dca353b7e123af39d7a9" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="7f5d31cf9aa970da3494de95aad3c2ef6ece38c58856656e7f5a433c59e6768a" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="c815ce3786a0bc8638a2f161e0034c4540c14284774384f91194abbb4ff5cf88" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="78561a748005b59a725eae2227597ef9bdcfffd63bb98963bdede9d4c86ff383" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="55a5303f024afe9d8bc547d739510a0aed8b1376578f080805d28f5a9b96ee23" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="fe49565c9279edbd03249f0827c54928a92915284c58f0609fb7bc3c1ee3011b" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="aa73c18b8ca8abd256b1d671c45352dceb8ca9168abf2f0ec74311094a3b8180" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="84d9bfb3a0027b59092644b59f4deba384b5af8a7552ebfc4be6296862b88c8d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="5fe2f87a758cbdba58cfd7eca0c6bc6648490b1123800306e5849ebd5c88b5d4" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="4848402913dbbd1a4baf8c9d77c3757fa28ebe1497058e36a2aa292f45a3040b" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="1a9aefbb250c4dbf14b962937aba483a2940e1cfadd278307a0db3aa50dbefa1" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="f5b394629a32b66333213e3131bade95982b843cf922197a8eb05ac63e133ede" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="636ce3c60c5d8a9f63daee64c637b9ee83ba5e8142c5d7ead4698d96624c30de" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="c1a02935c6b23d217ca112c4ddd3757cd685a37888da7e7cdbf73eeab502952a" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="15f0d605bcb7723a344fe144787f58f55096b266fa5b04ce4cd15be275dc4121" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="f939bb349923fcef51f36c9dfa0e854e7347fd6892ac79a86107b943edecc0da" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="47fcbd81f404ed34b7dcd34b7efe2518ae88f17ff08bfbb3b49960b1635a1208" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="ce64565d79961c0f23f2d830c87734dbabb2cf06d71756fc906ffd828e6b292b" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="46647e5aea60c669e9f0e648695e841b6a4085db90141c167c3a8957af2496cb" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="1db4367e640b78a191cd01f491a8566162b33626bb5229518ff6042dfa82aeda" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="a0dfa7a4e25e7d605835e0aa9349fd8fe219a884f44dcdc0293d96358dc56010" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="741b6a9852d8159aa51b7c8b1914298819f959fe80a43b60922a1be24189bc9d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="8a16b816f614d1ecec8745fc32b3bbe16c1356655b6574af4ca2494041e297f6" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="0535e53a92a6250994de95b6a51976a346c4d2d702c21839fd49b904093c80e4" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="18d111392f349a2feaea99ea492d75a2ee131a1754274ebb4deead00bd657bea" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="f57415cafd3671bdea59a2eb85a501938ef2c1d35067adfb641d1bc407e4302a" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="8c5e0204b0a53f08537400fc994f629afdcb8b53518625386d12678da19349d5" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="448976a3f3030790bab9b5f6038c6b92743eb8783406dedb8c7b764bac9f521e" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="f58553778f888aedec84c40103c2dec0cedc15312fe849ef77a398faa164d8cc" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="482de40ac0cd5963d4bec8ce73589e91c10f4bd9c8f8d1cb9dcec376203647b9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="2fb0a952b6a028252e150ef9e63acb4f564c4b4a4f8d7b43e735942c8f56347f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="947b3b7d53653f720ab26524a02ce96b2568ca45ec67db0fca19fee2073f41ba" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="1d5d1bd6d24f27766f3ab294f3a45ede5a868fb4eb9131fe5497328d2da92a22" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="6ab9e4dc28d53f0c13acf1e90fff90c6714d3ba6dab9c2630b24b011cf9275ce" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="736d0094677768c49dd2aa441acfc45f346d4a502101ae6b7289b0f26b5bab90" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="b735b06e14cbab61ccb6f421882043dfff5c2ebd0bc4cc80325ddcd7456de5fb" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="db188ab5484a282fdf98dbf44ad459d5dc0b6c0d5474605f595ab650cd4835a0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="2298b9c06eead6c3374ac7fc57fe2e3e9cdd33754ca065da9b61c4b740d82c63" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="5da5b209b7644d3e2381d3cfdb9d9b734ca4ab8dcc3c15ebcb64d58fd9bdf393" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="ce2153891220e57e01cb71a15fc79efe09b9afc11ad74ffe375b53cd0efdf729" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="3a4108b9a73d32d32e385805bab272157cc04471f2909f79b616a1a7cd1c2477" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="1d4198ca2f2d5bf0bc10c5c9b0701bfe97e100cc2d859801953d5d48b8c182a1" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="98f13cb71a273bd3f25f88466bcf458f9d1febe27fa058d26f9f4fe68b64e9fe" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="511cd15dc9c7291adb1c1f4637d67803f10745897eda566f9485799fca9e8bf9" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="a3a0d7c443d64aa46652a444e41c5b0f760d4e61abfcb769fc23d042a72a104c" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="e748c0cc2bd6be86b2b63f2a4a6f414cc76be7f228262aad553ab90290071271" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f76ba9a15dd433cc188228920cbbf64e754855b831e6a13e7e4592d42dbc4b59" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="c22b7640801e2aa534902d91580f1f2b28a459317276031c0f83f7455ff23169" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="179da15ffd12fc59e48406a46c5d9ee71f362a6e8c05796fd285db55f83a5c9f" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="eef9a2f306ba1cdd440886919a7413181575c2501297bf771b40542ecac1bd82" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="1423d9f0b73f58dc867c9b72e7713af43d308e806294810228e19c277ac4aab9" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="55f998c3e668722415019e304d81aca29bd94aec0d0269e868b01b7a29e984eb" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="e97103ef736bc9b2575b03a2ca71c1c53841a052b086f998c335a2b4db4dbf2a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="dd1c7c0e89c457e475f2fd425295eafb4c0dfb1cd25046563ea8e24b41c3250a" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="b339990c176a19356f44200201080ff8e587241dc982016e0879479badd1de5e" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="d7be8e9414a3ef4a4f71b591d53b9ca1a69ec46e6afc6350a0b077680bac6ed8" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="775fa81e91fe1337a0cf90ea8df9379b18c3eff8e231524b3d77c7276ddd45e6" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="703d4391a53731f266534beb70ef11e1b9eaae28debb6effecc842c8a85982ec" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="8fea53f0fca27893a877e812a704a4876a9d66b162b8a6dd35a6ac6c4fe4de08" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="e316184eed25dc084b9b9c6627a963f9a6a6bafd4456a42eecd4c62ed9c46533" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="90142c78de0dbc46921529b76afa97a5a590e8cbdd02cc03a863c9aa2c49adf6" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="c5f0e39684b502fe890131d6fbf695fdd76b72c00cced14b4799081e81f07f34" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="9c647d1e5792d1cc397512e44efb7194c6cfa7a07953fac6fa23b290f713b804" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="dc4c6e08304c318e254ff37cd5d9f5a8bd0fd8ac611ab060b94a443a9a5d50c0" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="b65807b91a88e734543af2d635fdf33e05cd5cf4b403ba6fdf81604d61648ff8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="704c9f6988b458419ea64abe55b03ab48a7afe87484651cd1c2d5b9241fed1e1" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="51840661a1a0b30cb5d2ab36fbc16e0307f99bb6466cc466f380ee4b84e89d7e" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="f434d65e8a3fb98633630e54322dad08c3d6876660099e0cd77baf477482c1b4" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="2a9d9277602e6e1ecaf54571436572f04f8310fbb490000ed0b99bb441483e09" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="c07f1648fbefc0ad454db5a4d2fdc4a8a8aac50a20b19b58f1bdbf6a7dcba1e2" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="01823a61a14aa9ef93f817cd27bef44cb190395c58309798ef3c38d3b67e8552" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="6f950bce2c60e8098cf08da4c9c2c07cdd86a27e39291a46003adb93e18ac765" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="12982c89456763632b5d700b63bddefe3b22180fb476ab4201fa7f9ca4316e2b" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="5f7f346dfdf0afd6f1383fb4c0ef0c63109858167fd059d0abf227c08503a877" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="2f1656860381a32aef8f7b87c35327604e8df97adefca4ac1c72cca299d05c13" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="192fd67e0560a815e6f387c41ea62b79566ffeee59f64a2001379d20604a1247" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="6380dd50f16985fdb1a5d7057f3f9c8829169ddae0be2d917a9cbc75c2c7dc36" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="de9f0e13eb7ad33a64880789cbbdd36fbeb972e3f050aa04470204d0c45b94a8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="b65f5829365f6947fdfe88537e4e66c90edb7b42b6a5f9687cd37047c241b62a" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="045a41ed99c183f9dffd746080a77298e14f925c854aeaeb094825c59bdfbe9f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="9f3de5ed7a14642859577c848a09e98f5a2956f812656362ffa0ccc12e413106" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="1214ef67725665e5b2d182f017f55613dc0e94bbb8644b3a8868e2b2dc97e307" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="09748d29c51b894846f1920a53e7e732ba62c5b50d59468c7fc0d92a8cc173a1" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="1a19dc5dd476d80cf2bcc8e4a6798f557bb3f10f6222557d7970ffa7a179d484" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="af5c04b32810f6795a4cc7681c185898ab9858c1083101e1fae0998304529b29" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="98cc6a7edbec508e6c3d70808ad82a3d9a84aa0df971e1fa8e113a0849e23fff" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="fe69c71fe7d45387ef26789ab9b6a3667be544eb5c3fc0ead0331aa0de58ad57" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="a98f9a60c88f35f284578236846633d4c271db881b8c3e73fad64486469efeed" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="abe6da601c2331321e0791536bd90e774bc7e10f9a6b8536c2fb1ad374475a3d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="7f77b9ce437770623f8496dfa9ef45b7c04ed1ab1b3f9a42154fee6993af03cf" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="4b048961ec4210055a279b7b18994f7004a5070979e2bb738156b791af6fcad2" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="07b3fab31ebfeef99dfebeff3348b080f9e33d9b7972b5b4d2da79a6cc270c23" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="ae8e7320c5a77a1c7c946944c184c151c4d333e25484959c3901830b427206d6" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="9ec92d753242bab8c24b14d303d48f271ed5779050b7ed5255a210c72962161d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="8a1cb50328ba4fefa4c35aada19f278543fe979e8aadf635efb7aea7cdac55fb" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="3cfe350fdb87c6bea431a35b14baebc633ef2bcd3507fcf6e314de83f63b1ef2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="f5fdeb91ac8bf0e5e3f91f35f7b864a9a9a4520aabb4426a5dc6cfc565c77db4" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="4023a53e8612cfaa1c096cfc9ac6164d94c524f6a2f66a4fc24b26cb35045724" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="340853a4eb4701dbc5e74dc16895b96310fbd9fc8e63d765f1cf1e5b5dbd3740" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e457f5ef01f89a1f022921baac4a1d35230c57ea32ec8d7978563110f5cfffa2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b0ac97b40d87c6d9502fed1c5285f898cb75f31e906f4dc3f52746d749fcd252" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="d399456b4a1b8164966ab87cedfbb2d438d48e009f41e7740c12150543f494a9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="6039b8b0bc5515e07d4aaba1b7cc1eb3392b081cf4f1668066c2e5ffea90154c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="1a1b3e5454ef2e41e0c241517e546d2a7689bf64b2b45658103bf1f6975c2ee5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="765c3c0ffdb5f114ea052de9fd2ea5e704baad326b61dabe0b733d5f3f88af14" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="92826377dbcb622c28f978f152121aba730e7e40c44e12b8ac07eac8cd632038" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="c4012221bf66fcc1f4b2003da578318f3742e3acc5f1c03f2da8827ff820e8de" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="e9e7999625fd7f3ff66bad652b16800ee37575264ba28359eafae0bd03570292" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="6a25f8da9bc2f44987101ef8aaac5042541e2b8ee15509fde5e42590629c6b5d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="0aa06057b6e3156fa2d2c422f3c8758d083f87c103b9c1e3f153c07edd3286f3" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="697ad876855f229fdaef6e079ecd0489de46aa59eb5bff824be1b6bed0e87c6c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="5984077f427c11b75d4bc07cffa0f76b9ef1115dd9aa08f3af2eac6d146300c2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="12df5fafa50d1d008456bc98ad366a2151ac7b6c6cef2fbfc6d285c699ea1791" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="b6b765e7bd56d963fefd11a5f989bbfa693b53794d694f3ac47f7a1d395550b8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="c546c316a383e40c23a64cb3ba1b15a9d4923a98e66680347eb13cdf73af9efa" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="234af5a9208cb1fad0ea1ef87e559cc7ae192a274cab8177eff52da34cdee74e" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="a1a34dd89234017ef87e0555bf0f993c6ff1d61361b4639f4b0581c7f41886c1" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="b33a2dd5cc07463cae18a64b188be209a8b6abe2d6196e76859b7a8dcb7f0420" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="a67150da2f2e7d9238c3278f20d206e5c0d3eef06e2b87e100ee20d47b78c7ea" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="5a7e8258b6260f0df1a7dc2ace1890c726625bf1f3d285f46791352bdf054ef2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="dc676024772d23a8e5bee4d3a7d1e716c1ad1caebc3ef23ddb63f910d892876a" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="7321daf17a85f56b28fa7b322c706025c4591171e6b7ab97bee5f93f6319067b" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="844ecb627f43044a7cbafe62556d8e88757e6fe85fcb0791211b4d6f6fcd3422" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="4aef570cd12f7e4084c98299118468a3f35c89b108f341501e6d8507466d53d9" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="038179e2ff3dc0f396be1b7dd6067ac0eedca9368d7834fd1ca56d3265c17f1e" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="79e49a517e83cf64e62efbd08c42da74661ff0f3a387e5785b970c6b4569d1a2" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="9fa5b8d0ec3bc3a701e6548b44995ef867f524cc05c69203c6820e273ad780f8" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="80f7454d5fefd0eff4dc57939a3b5b5c1349e06770627a3b371571679fa83494" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="a9761746e90d00fbb9aa4f85404461ebaf9a949f2e90c58b93b15342b8f919be" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="59c8df696027c93d6e454a1b1ec00fd0a2a4470ec1f5e1f20421929b64c38d89" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="90becdaaedda64d5b2ac49e261fa44fd81b9d34779e737df1ebd033fc27ab8fe" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="deb9803028a9c379627c596b7270b6b56c0d33b73d24edb1d2d5c2f893cca970" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="9278122f22defc892f2e5c86f58b3b1941a58bcbf45566fcf3d2a29790537202" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="76a9e84caa963a1859dbd95d288f368c13afd6520e00f71877e33e94e18420ec" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f0b105b8a2a45cd3daf8cf1d989a5ba6518da09ecf32306072ba4ce05aade6eb" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="ef44947b5adbc3f3f4875b5267edb0ab593b215e7b1e15ee7162d6baebe38b09" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="1f8d94f1c5bff346d9157c65a079d95346d405b1cb412ef766a21d75275ebd2a" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="d4138cf4bc233838bbf58a5cf579c63e20ce97fd2c4388b22643640b39006349" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="23d663523ebc537da574f136b6a50507e3a5a4bf28e6713ca2bbc0b90d3e8424" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="b68e00d8ab6b6400eb8257a77de2f9a9769baf9d68b793d2d37bf2b474257568" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="ae74bb56f29c30f7b373042a511191da56bdbd40d6a19966792e5da03c8672b2" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="e6167bb6c9b5453e7bf50a0aa81279f6516c66a3d123bf8868530f264511c3a1" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="1b991d0cada8bceb33965dbc75dca6b8281c5b7a28da39fb2b99be1e3f5a2823" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="d48166e639eda57c7b2b9a11b8d9ed1a9dfd89272863cf40f4ab0f45260f46d0" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="865af8324e667cbfb1aa4cb09aec950a07b4360eabb1d4950a064c66541dfb15" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="f0ba8a95f0f5a3e24668519f37007d55cdf1b48f504f8dfdf86c85e674674d01" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="888aab8170025495741a258148f5260395aa8263ce482e801e382f30f1329b51" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="91b0474d00b1edcc016c515f4986c1e92f4d2c8b7ffa5e37a8e12b6114a7b1f7" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="af03308feddd78a53d3c5c30f7d2c110c1b7a5babd2a074a3e07ff0bf10722ca" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="6b56d20a5fef431fc29b9c96493bdf9a2283ae2af9847be01552773ea06a0ceb" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="05a91e4b4154135408783f461e634c297db9203af355cfd5e76d21a5363f901c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="0c053e00ceb76360de2d205a4d52948e2be6bb65a5ba3a4adb1bafb3d9ce82d4" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="21acb807f04a82070c3a8683b6941c62aa90ccd35241247822c11219018c3088" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="004efe56ad6bb1c7ea17f2d85d9c74ce995ad54e7526f18d4957b88e5ca210a9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="79127f486dc9da2722abaf266125f41d62fa5d6f7a7761876b24ded06db35f09" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="4253b57fbb2eed591c5eec5defa16fe66d3d288be3a3890963082b2a1e924188" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="c28e12d53e8610edf76dd1b0d6b26d830d28d98a08a815d36dbd2c7a38676c18" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="c5cfc08027df5506da820ec7071ad6e9451cfbb22f62e01c07fd60760c13cfad" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="b780ab4c1e19f17ce22daf8fa37e840f22f4a686b06c67b271444ade4c006940" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="a1931f7fefcd6b0133ed5072c001095366bcf4f119234debc038e6ea43d90420" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="102.2.2" rel="150200.8.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
</package>
<package pkgid="b33e0bb3eee0f9c1da317533096abef25d8aabac463db025d32910b31f57c4b9" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="bdcf0222955e33d88ca5dec077eb1d6d8c367fb76de01c9dc4528ff1a3cf4579" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="f3dd9759542532daf0d6b988f644bdbf4afdba4f2729be14e96de35fd9682a2c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="0e7101c81948bf964c0f2c83c385ddd1ef8012e173031f72ca9db65d9c83fff5" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="102.4.0" rel="150200.8.85.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  Placeholder changelog-entry (bsc#1204421)
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
</package>
<package pkgid="08ceebd5f80cb6500d01f4447f7601b20cda452307fd0665951e94c4c66080e1" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="ce0f8ab59cd2937a736040aa2d561ffc25ca4046d6ff79400fb2cbc5d9f36b62" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="b849baae6b3696a6c6d5879aeaa483cd23de41dc2d110ea833f225d6d1bddcda" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="5bf7a07d404d8d68059cf995401bab073e6b1ab9ed327951c67deec75c2c54eb" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="102.5.0" rel="150200.8.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
</package>
<package pkgid="0a96f036759d980a408cfbf5b573aaeecc374ca82c994715bea960c89b65109b" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="2cc37e64eced95f4da839b23695ad086088b1e6b6e8e2973818e9a7370a217f0" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="0495168ab3d7ece9eb9a72687e1e195eee02b159cc3f97234d3df6e63e1c34f5" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="4d203f6d140e079ae9a31866659e89eb4c16c4d37254cf52d88f42802fdc5255" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="102.5.1" rel="150200.8.93.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
</package>
<package pkgid="c1882a2e2e69f779ebc1ebe9cf91abc117697f3207e33c819dbaf7d0c7cd11de" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="ac61b2a3090da1e68daa4692d8ef4af4efafe7f2be787badeb0c529e24c35d7f" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="8f631a8a8e556ef79cdec720d56f84a39616182e4088d6c524230b6b646b5beb" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="4a9a671be3a6e90094de216721d0052b60581e9defca737384be90692aa0d030" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="102.6.0" rel="150200.8.96.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659960000">- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Mozilla Thunderbird 102.1.1
  * changed: OpenPGP Key Manager will clear selected keys after a
    deletion is performed
  * fixed: Update notification popups were still displayed after
    switching to another desktop workspace on Linux
  * fixed: macOS display issues made Thunderbird unusable
  * fixed: OpenPGP public key was not automatically attached
    after enabling encryption from reminder and default setting
    is "Do not encrypt"
  * fixed: Importing OpenPGP keys stored in binary format failed
  * fixed: Exporting an OpenPGP public key from Account Settings
    failed
  * fixed: Saving encrypted OpenPGP attachments created corrupt
    files
  * fixed: Receiving many OpenPGP keys in a single email caused
    Thunderbird to hang
  * fixed: POP3 message download progress bar was not displayed
  * fixed: OAuth2 authentication was not available when the mail
    domain did not match the OAuth provider domain
  * fixed: OAuth did not work with some POP servers
  * fixed: RSS feed URL links in headers panel could not be
    activated by keyboard
  * fixed: Self-signed TLS certificates did not work with POP3
    connections
  * fixed: Non-ascii characters in passwords did not work with
    POP3 connections
  * fixed: An error was not displayed when an incorrect password
    was entered for a POP3 account
  * fixed: NNTP articles were not displayed in preview pane when
    a Primary Password was set
  * fixed: NNTP articles did not download when the hostname of
    the server was not all in lower-case
  * fixed: Saving NNTP messages to local disk failed
  * fixed: Drag and Drop from Address Book into Compose window
    sometimes added unexpected contacts to the target
  * fixed: "Default" label not shown for emails when editing a
    contact
  * fixed: Contact Title, Role, and Organization fields could be
    displayed in the wrong order
  * fixed: Contact birthdays on February 29 were displayed
    incorrectly in non-leap years
  * fixed: Detection of photos in vCards improved
  * fixed: Drag and drop contacts to another address book was not
    available
  * fixed: Contacts stored in a Google CardDAV address book
    contained extra backslashes in text fields
  * fixed: Contacts without First/Last/Display Names appeared
    blank in contact list
  * fixed: Auto-attaching vCard and OpenPGP keys did not always
    work as expected
  * fixed: Settings page used caused excessive CPU usage
  * fixed: Calendar did not respect `Date and Time Formatting` in
    Settings
  * fixed: OpenPGP Key Import wizard did not adapt to dark theme
  * fixed: Various visual and theme improvements
  * fixed: Various accessibility improvements
  * unresolved: "Get Map" feature missing from address book for
    physical addresses
- Mozilla Thunderbird 102.1.0
  * fixed: Activity Manager did not display POP message downloads
  * fixed: Mail Folder Properties dialog was not sized correctly,
    cutting off contents
  * fixed: Expired news messages did not display an error
  * fixed: Calendar Column Picker closed prematurely after
    selecting/deselecting a single column
  * fixed: Various UI improvements
  * fixed: Various security fixes
  MFSA 2022-32 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Thunderbird 102.1
- Mozilla Thunderbird 102.0.3
  * changed: Support for Google Talk chat accounts removed
  * fixed: Thunderbird could crash on startup on Windows 11
  * fixed: After compacting folders, new downloaded messages were
    inaccessible
  * fixed: Marking a message as a Favorite (starred) did not
    update the thread pane when using Unified Folders
  * fixed: Compose window failed to populate some fields when
    S/MIME was configured
  * fixed: Non-text attachments has an incorrect
    "charset=windows-1250" mime header
  * fixed: Messages sent as attachments incorrectly had an
    "X-Mozilla-Cloud-Part" header
  * fixed: Improved Address Book import/export support in Profile
    Importer
  * fixed: IMAP stability improvements
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: Signing S/MIME messages failed
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.2
  * changed: Double-clicking chat messages will no longer execute
    a default action
  * fixed: "File" menu was covered by Spaces Toolbar
  * fixed: Sub-folders with new messages were not highlighted
    until clicked
  * fixed: Attachment paper clip was cut off in message list
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Non-ASCII messages forwarded as attachments were
    garbled
  * fixed: Importing from Seamonkey or Outlook failed in second
    step
  * fixed: Deleting messages from a POP server occasionally
    failed
  * fixed: Offline cache was unusable for NNTP accounts
  * fixed: News messages were not shown in preview pane
  * fixed: Address fields were not populated when using "Edit as
    new message"
  * fixed: Sometimes only the first letter of a contact's
    Organization name was displayed
  * fixed: Double-click to edit selected contacts action did not
    work
  * fixed: Some CardDAV contact fields were displayed with
    additional backslashes in the value
  * fixed: Pending chat message contents were not updated when
    the conversation was not selected
  * fixed: Various UI improvements
- Mozilla Thunderbird 102.0.1
  * fixed: Mailbox MSF files could become corrupt in some
    circumstances
  * fixed: OpenPGP Key Assistant did not show status for
    addresses handled by aliases
  * fixed: Attaching an external OpenPGP public key failed if
    configured with a subkey ID
  * fixed: Thunderbird continued using an old password after
    changing it
  * fixed: New mail notifications were only shown for one mail
    account when multiple accounts were configured
  * fixed: LDAP Address Books could not be configured using IPv6
    address literals
  * fixed: CardDAV contacts (notably Google-hosted) with more
    than one email address were not always editable
  * fixed: Address Book accessibility improvements
  * fixed: Various UI improvements
  * fixed: Icons converted to new style
- Mozilla Thunderbird 102.0
  * new: Thunderbird will now display a message when an upgrade
    migration task is taking a long time to complete
  * new: es-MX localized build now available
  * new: What's new link displayed in About: dialog
  * new: Profile Import/Export UI refreshed and moved to a tab
  * new: Commandline tools now included for OpenPGP debugging
  * new: Thunderbird may now be built with OpenPGP support and a
    system librnp
  * new: Added menu option to permanently decrypt OpenPGP
    encrypted messages to a folder
  * new: OpenPGP: Public keys from email attachments and
    autocrypt headers now cached for future use
  * new: Expired OpenPGP recipient keys now indicated in compose
    window
  * new: OpenPGP Key Assistant enabled by default
  * new: OpenPGP Key Properties now supports refreshing keys from
    key server
  * new: Spaces vertical toolbar for easier in-app navigation
  * new: Compose toolbar button for OpenPGP &amp; S/MIME signing
    available via "Customize Toolbar"
  * new: "Select all addresses" now supported from composer pill
    context menu
  * new: Multiple active spelling dictionaries now supported in
    compose window
  * new: `Add dictionaries` item added to `Spelling` button in
    compose window
  * new: Added config option to more aggressively warn sender
    about having many public recipients to an email
    (`mail.compose.warn_public_recipients.aggressive`)
  * new: Exporting current profile now supported on importing tab
  * new: Back/Forward keyboard shortcuts added to Addon Manager
  * new: New Address Book UI and significant backend overhaul
  * new: Importing sqlite address books now supported
  * new: Importing addressbooks via CSV file now supports semi-
    colon (;) delimited files
  * new: Opening a **news://** URL now works if an account is not
    configured for that news server
  * new: Google Talk chat accounts now support logging in with
    OAuth2
  * new: Matrix chat support enabled by default. This is a
  * *beta** feature.
  * new: Printing using the system dialog without preview now
    supported; Set `print.prefer_system_dialog` to `true`
  * new: Removing events from a calendar now prompts for
    confirmation
  * new: Upcoming events in the Today Pane show how far away they
    are
  * new: Icons now displayed on recurring events and modified
    events within a recurring series
  * changed: SMTP client will now ignore socket errors after
    `QUIT` command is sen
  * changed: Javascript POP implementation enabled by default
  * changed: Buttons on "Update Failed" popup now open Beta and
    Release specific pages on Thunderbird website
  * changed: Replace "About Junk Mail" dialog with a link to the
    support page
  * changed: [macOS] Account settings moved to application menu
  * changed: New profiles will default to using "Threaded"
    message view
  * changed: "Discover OpenPGP Key" context menu item is no
    longer displayed when a key is already available
  * changed: Duplicated OpenPGP encrypted attachments were shown
    when `display-attachments-inline` was enabled
  * changed: Replaced Security compose toolbar button with
    Encryption toggle and Encryption options buttons
  * changed: OpenPGP dialog for key "acceptance per email" now
    displayed in more circumstances
  * changed: OpenPGP `Key Manager` dialog layout improvements
  * changed: Writing OpenPGP keyring data will block Thunderbird
    shutdown to prevent data loss
  * changed: When automatically attaching OpenPGP keys to emails,
    Thunderbird will strip key certificates
  * changed: A notification bar in the compose window will be
    displayed if encryption is possible but not enabled
  * changed: Inline attachment filenames now sent without data-
    uri encoding
  * changed: Per-recipient and per-domain email format
    preferences removed; Sending options moved to Compose
    Settings
  * changed: Thunderbird can now be used without setting up a
    mail account
  * changed: NNTP account set up moved to its own wizard; "Other
    accounts" wizard removed
  * changed: Account Manager UI updated
  * changed: Email account provisioner moved to a tab
  * changed: Link to create a new email address in Account Setup
    now hidden if "Email address" contains a value
  * changed: Addon Search will no longer display addons that are
    incompatible
  * changed: Searching from the `Themes` page of Addon Manager
    will now limit search results to only include themes
  * changed: Additional fields for download limits, expiration,
    and password protection added to FileLink template
  * changed: FileLink will check the provider for sufficient
    space before uploading
  * changed: "PreferMailFormat" property removed from addressbook
  * changed: Address book contact data is now stored in the vCard
    format. The change isn't backwards-compatible; backups are
    stored in the profile directory.
  * changed: Default install directory for Thunderbird Beta
    changed to not conflict with release versions
  * changed: Tab icons updated
  * changed: Message Header toolbar buttons will not display a
    border when set to show icons only
  * changed: New message detection for non-INBOX IMAP folders
    improved
  * changed: New Javascript NNTP implementation enabled by
    default; Set `mailnews.nntp.jsmodule` to `false` to disable
  * changed: Preference for OTR encrypted conversation logging
    moved to Protocol settings
  * changed: Thunderbird will not try to use OTR Chat encryption
    if the protocol supports native encryption
  * changed: Invitations to IRC and XMPP chat rooms will now
    prompt the user if they would like to join
  * changed: Today Pane UI refreshed
  * changed: Thunderbird will not support "Secondly" or
    "Minutely" recurring calendar events
  * changed: Default action of `Edit` button in recurring event
    dialog changed to display submenu
  * changed: Support for importing and exporting calendars from
    Outlook CSV format was removed
  * changed: Thunderbird will now delay refreshing cached
    calendars at start-up
  * changed: Javascript Ical parser (ical.js) enabled by default
  * fixed: Opening "cid:" links failed
  * fixed: Message download progress was calculated incorrectly
  * fixed: `Ctrl+mouse wheel` did not zoom in the message source
    window
  * fixed: `Open message in containing folder` did not work for
    standalone windows
  * fixed: Multi-message view was not fully scrollable
  * fixed: Messages did not reload in all open windows after Junk
    status was changed
  * fixed: Detached attachments were opened from a temporary copy
    instead of the selected save location
  * fixed: IMAP folder subscription changes on servers using
    OAuth2 authentication were not reflected in folder pane until
    Thunderbird was restarted
  * fixed: Improved error reporting for external GnuPG
    configurations
  * fixed: Incorrect OpenPGP preferences were used for secondary
    identities
  * fixed: Adding an expiry date to an OpenPGP key that did not
    have one was not possible
  * fixed: UI showed old OpenPGP key expiry date after changing
    it
  * fixed: Importing large OpenPGP key files failed
  * fixed: OpenPGP "Repair Message" button did not work with some
    emails
  * fixed: Importing OpenPGP public keys without a blank line
    following the header failed
  * fixed: Dragging and dropping multiple email attachments
    between windows did not always copy all attachments
  * fixed: Attachment bar in message compose window was not
    keyboard accessible
  * fixed: Triggering recipient pill creation in the compose
    window incorrectly used the entire field as input
  * fixed: Compose notification bars were not easily accessible
    via keyboard
  * fixed: "Save message" confirmation dialog buttons were not
    navigable using arrow keys
  * fixed: Focus jumped in compose window when closing the
    contacts sidebar
  * fixed: Save dialog was incorrectly shown when closing empty
    composer windows
  * fixed: Incorrect access key used for `File-&gt;New-&gt;Message`
    menu item
  * fixed: Changing focus in the compose window with multiple
    recipient pills selected did not always deselect the pills
  * fixed: Sending a message with non-ascii characters in
    recipient local parts failed unexpectedly when the server did
    not support SMTPUTF8
  * fixed: LDAP Autoconfig could block Thunderbird startup
  * fixed: Improvements to the Import/Export feature
  * fixed: Configuring multiple SMTP accounts using the same
    server was not possible
  * fixed: `Empty Trash on Exit` did not work with IMAP accounts
    using OAuth2 authentication
  * fixed: IMAP server hostname changes were not reflected in
    `Folder Properties` dialog
  * fixed: Addons automatically updated when Thunderbird updated
    despite Addon updates being turned off
  * fixed: Message size calculations incorrectly included
    FileLink attachments
  * fixed: After converting a FileLink attachment back to an
    e-mail attachment, the privacy notification persisted
  * fixed: A failed FileLink provider change removed the
    attachment completely
  * fixed: Subscribing to CardDAV address books from Account
    Setup tab did not subscribe to all selected address books
  * fixed: Adding CardDAV address books failed if an addon-
    provided address book was present
  * fixed: Messages with Message-Id headers longer than 332
    characters could not be forwarded
  * fixed: SMTP send progress bar could trigger high CPU usage
    when the server connection failed
  * fixed: Improved POP server authentication detection during
    Account Setup
  * fixed: News folders did not display biff indicator
  * fixed: IMAP flag changes from another client were not seen
    after some inactivity
  * fixed: Recipients were not de-duplicated before sending,
    leading to sending errors
  * fixed: Chat conversations' context menu did not recognize
    links
  * fixed: Chat username splitting in the account wizard did not
    work after changing protocols
  * fixed: Removing obsolete proprietary chat accounts did not
    work
  * fixed: OTR encrypted chat did not work on FreeBSD
  * fixed: Event edit toolbar button was not disabled when an
    invitation was selected
  * fixed: Event view headers and content were not lined up
    consistently for RTL locales
  * fixed: Mini-month views did not properly update at midnight
  * fixed: Some labels in Calendar were displayed in multiple
    languages
  * fixed: Thunderbird permitted inline editing of read-only
    event titles
  * fixed: Calendar view reloaded when switching tabs
  * fixed: It was possible to create annual calendar events with
    invalid days
  * fixed: Detection of attached vCalendar files improved
  * fixed: Reminders for events created by another user could not
    be closed
  * fixed: MS Teams meeting event descriptions were unreadable
    when stored on Google Calendar
  * fixed: Adding a Google calendar with a non-gmail or
    googlemail e-mail address failed
  * fixed: Accepting a recurrence exception to an event accepted
    event associated with the original recurring event rather
    than the exception
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662033600">- Mozilla Thunderbird 102.2.1
  * new: Commandline argument to open Calendar at startup added
    (`-calendar`)
  * changed: Buttons to connect automatically discovered Address
    Books and Calendar during `Account Setup` now displayed
  * fixed: Compacting IMAP folders failed when "Just mark as
    deleted" was set
  * fixed: Message threading status and sort order was not
    transferred when applying column layout to other folders
  * fixed: Folder names with half-width Kana characters were
    displayed incorrectly
  * fixed: Digital signing of messages was not disabled after
    switching to an identity that could not sign
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored
  * fixed: Activity Manager didn't show "Get Messages" activity
    when "Leave messages on server" was turned off and no new
    messages were found
  * fixed: Mail quota color did not update properly for multiple
    accounts
  * fixed: Profile export failed if an expected file did not
    exist
  * fixed: `Check Spelling` dialog could exceed screen size when
    many dictionaries were available
  * fixed: Dragging a news message to the Desktop caused
    Thunderbird to hang when synchronized for offline use
  * fixed: `Remove All Expired Articles` was not displayed on
    expired NNTP messages
  * fixed: Sending messages to encrypted Matrix rooms failed in
    some cases
  * fixed: Adding a CalDAV calendar on BSD-based OS's failed due
    to DNS errors
  * fixed: Various visual and UX improvements
  * fixed: Various security fixes
  MFSA 2022-38 (bsc#1203007)
  * CVE-2022-3033 (bmo#1784838)
    Leaking of sensitive information when composing a response to
    an HTML email with a META refresh tag
  * CVE-2022-3032 (bmo#1783831)
    Remote content specified in an HTML document that was nested
    inside an iframe's srcdoc attribute was not blocked
  * CVE-2022-3034 (bmo#1745751)
    An iframe element in an HTML email could trigger a network
    request
  * CVE-2022-36059 (bmo#1787741)
    Matrix SDK bundled with Thunderbird vulnerable to denial-of-
    service attack
- Mozilla Thunderbird 102.2
  * new: Config setting added to disable OpenPGP "encryption is
    possible" reminder: `mail.openpgp.remind_encryption_possible`
  * changed: Thunderbird on macOS will now prompt for Primary
    Password on startup if set
  * changed: Thunderbird will no longer offer to import OpenPGP
    keys that are incomplete
  * changed: Selecting or unselecting a dictionary in the
    `Spelling` compose toolbar button will no longer immediately
    close the menu; Making dictionary changes via the editor
    context menu will continue to close the context menu
  * changed: Contact address lines are now adjusted to appear in
    the expected order
  * changed: Custom1-4 fields restored to Address Book UI;
    existing data is preserved from pre-102 profiles
  * fixed: Thunderbird startup performance improvements
  * fixed: `ALT+&lt;numpad digits&gt;` keypress events were intercepted
    by the Spaces Toolbar, preventing special character entry on
    Windows
  * fixed: Searching on attachment status did not work in Message
    Search dialog
  * fixed: Repairing IMAP folders in Offline mode removed local
    copy of the folders
  * fixed: POP3 message download progress bar was not displayed
  * fixed: POP `Fetch headers only` mode did not work for some
    server configurations
  * fixed: POP accounts using GSSAPI or NTLM authentication were
    not able to log into the server
  * fixed: A TLS certificate override dialog for self-signed
    certificates was not shown for IMAP accounts
  * fixed: Saving attachments from newsgroups did not work
  * fixed: Setting contact type to "None" was not possible if a
    type was previously set
  * fixed: Editing a contact without Name fields populated filled
    in the email address into the name fields
  * fixed: Address book toolbar buttons were not keyboard
    accessible
  * fixed: Auto-detection of CalDAV and CardDAV via DNS records
    used server domain leading to failures
  * fixed: Various visual and theme improvements
  * fixed: Various security fixes
  MFSA 2022-36 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Thunderbird 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Thunderbird 102.2, and
    Thunderbird 91.13
- Mozilla Thunderbird 102.1.2
  * fixed: The fix for bug 1777765 (no POP download progress bar)
    was backed out from this release to address broken POP
    message download with `Fetch headers only` selected in
    Account Settings (bug 1783552).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1662638400">- Mozilla Thunderbird 102.2.2
  * changed: Setting added to change Calendar event double-click
    action to open `Edit Event` dialog rather than view only; Set
    `calendar.events.defaultActionEdit` to `true`.
  * fixed: Running `Compact Folders` on maildir folders caused a
    redownload of all messages in the folder
  * fixed: Accessing mail folders in profiles with many folders
    was slow
  * fixed: SMTP servers were not always properly initialized, and
    were not listed in `Account Settings`
  * fixed: APOP authentication unsupported when connecting to
    POP3 server
  * fixed: OpenPGP key discovery failed
  * fixed: POP accounts hosted by AOL were not able to
    authenticate using OAuth2
  * fixed: Unable to open context menu in newsgroups header for
    groups that are not subscribed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Mozilla Thunderbird 102.4.0
  * changed: Thunderbird will automatically detect and repair
    OpenPGP key storage corruption caused by using the profile
    import tool in Thunderbird 102 (bmo#1790610)
  * fixed: POP message download into a large folder (~13000
    messages) caused Thunderbird to temporarily freeze
    (bmo#1792675)
  * fixed: Forwarding messages with special characters in Subject
    failed on Windows (bmo#1782173)
  * fixed: Links for FileLink attachments were not added when
    attachment filename contained Unicode characters
    (bmo#1789589)
  * fixed: Address Book display pane continued to show contacts
    after deletion (bmo#1777808)
  * fixed: Printing address book did not include all contact
    details (bmo#1782076)
  * fixed: CardDAV contacts without a Name property did not save
    to Google Contacts (bmo#1792101)
  * fixed: "Publish Calendar" did not work (bmo#1794471)
  * fixed: Calendar database storage improvements (bmo#1792124)
  * fixed: Incorrectly handled error responses from CalDAV
    servers sometimes caused events to disappear from calendar
    (bmo#1792923)
  * fixed: Various visual and UX improvements (bmo#1776093,bmo#17
    80040,bmo#1780425,bmo#1792876,bmo#1792872,bmo#1793466,bmo#179
    3543)
  * fixed: Various security fixes
  MFSA 2022-46 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Thunderbird 102.4
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0
- Added mozilla-partial-revert-1768632.patch to fix build on i586
- Mozilla Thunderbird 102.3.3
  * new: Option added to show containing address book for a
    contact when using `All Address Books` in vertical mode
    (bmo#1778871)
  * changed: Thunderbird will try to use POP NTLM authentication
    even if not advertised by server (bmo#1793349)
  * changed: Task List and Today Pane sidebars will no longer
    load when not visible (bmo#1788549)
  * fixed: Sending a message while a recipient pill was being
    modified did not save changes (bmo#1779785)
  * fixed: Nickname column was not available in horizontal view
    of Address Book (bmo#1778000)
  * fixed: Multiline organization values were displayed across
    two columns in horizontal view of Address Book (bmo#1777780)
  * fixed: Contact vCard fields with multiple values such as
    Categories were truncated when saved (bmo#1792399)
  * fixed: ICS calendar files with a `FREEBUSY` property could
    not be imported (bmo#1783441)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
- Mozilla Thunderbird 102.3.2
  * changed: Thunderbird will try to use POP CRAM-MD5
    authentication even if not advertised by server (bmo#1789975)
  * fixed: Checking messages on POP3 accounts caused POP folder
    to lock if mail server was slow or non-responsive
    (bmo#1792451)
  * fixed: Newsgroups named with consecutive dots would not
    appear when refreshing list of newsgroups (bmo#1787789)
  * fixed: Sending news articles containing lines starting with
    dot were sometimes clipped (bmo#1787955)
  * fixed: CardDAV server sync silently failed if sync token
    expired (bmo#1791183)
  * fixed: Contacts from LDAP on macOS address books were not
    displayed (bmo#1791347)
  * fixed: Chat account input now accepts URIs for supported chat
    protocols (bmo#1776706)
  * fixed: Chat ScreenName field was not migrated to new address
    book (bmo#1789990)
  * fixed: Creating a New Event from the Today Pane used the
    currently selected day from the main calendar instead of from
    the Today Pane (bmo#1791203)
  * fixed: `New Event` button in Today Pane was incorrectly
    disabled sometimes (bmo#1792058)
  * fixed: Event reminder windows did not close after being
    dismissed or snoozed (bmo#1791228)
  * fixed: Improved performance of recurring event date
    calculation (bmo#1787677)
  * fixed: Quarterly calendar events on the last day of the month
    repeated one month early (bmo#1789362)
  * fixed: Thunderbird would hang if calendar event exceeded the
    year 2035 (bmo#1789999)
  * fixed: Whitespace in calendar events was incorrectly handled
    when upgrading from Thunderbird 91 to 102 (bmo#1790339)
  * fixed: Various visual and UX improvements (bmo#1755623,bmo#17
    83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178
    9728,bmo#1790499)
- Mozilla Thunderbird 102.3.1
  * changed: Compose window encryption options now only appear
    for encryption technologies that have already been configured
    (bmo#1788988)
  * changed: Number of contacts in currently selected address
    book now displayed at bottom of Address Book list column
    (bmo#1745571)
  * fixed: Password prompt did not include server hostname for
    POP servers (bmo#1786920)
  * fixed: `Edit Contact` was missing from Contacts sidebar
    context menus (bmo#1771795)
  * fixed: Address Book contact lists cut off display of some
    characters, the result being unreadable (bmo#1780909)
  * fixed: Menu items for dark-themed alarm dialog were invisible
    on Windows 7 (bmo#1791738)
  * fixed: Various security fixes
  MFSA 2022-43 (bsc#1204411)
  * CVE-2022-39249 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack by malicious server administrators
  * CVE-2022-39250 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a device
    verification attack
  * CVE-2022-39251 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to an
    impersonation attack
  * CVE-2022-39236 (bmo#1791765)
    Matrix SDK bundled with Thunderbird vulnerable to a data
    corruption issue
- Mozilla Thunderbird 102.3
  * changed: Thunderbird will no longer attempt to import account
    passwords when importing from another Thunderbird profile in
    order to prevent profile corruption and permanent data loss.
    (bmo#1790605)
  * changed: Devtools performance profile will use Thunderbird
    presets instead of Web Developer presets (bmo#1785954)
  * fixed: Thunderbird startup performance improvements
    (bmo#1785967)
  * fixed: Saving email source and images failed
    (bmo#1777323,bmo#1778804)
  * fixed: Error message was shown repeatedly when temporary disk
    space was full (bmo#1788580)
  * fixed: Attaching OpenPGP keys without a set size to non-
    encrypted messages briefly displayed a size of zero bytes
    (bmo#1788952)
  * fixed: Global Search entry box initially contained
    "undefined" (bmo#1780963)
  * fixed: Delete from POP Server mail filter rule intermittently
    failed to trigger (bmo#1789418)
  * fixed: Connections to POP3 servers without UIDL support
    failed (bmo#1789314)
  * fixed: Pop accounts with "Fetch headers only" set downloaded
    complete messages if server did not advertise TOP capability
    (bmo#1789356)
  * fixed: "File -&gt; New -&gt; Address Book Contact" from Compose
    window did not work (bmo#1782418)
  * fixed: Attach "My vCard" option in compose window was not
    available (bmo#1787614)
  * fixed: Improved performance of matching a contact to an email
    address (bmo#1782725)
  * fixed: Address book only recognized a contact's first two
    email addresses (bmo#1777156)
  * fixed: Address book search and autocomplete failed if a
    contact vCard could not be parsed (bmo#1789793)
  * fixed: Downloading NNTP messages for offline use failed
    (bmo#1785773)
  * fixed: NNTP client became stuck when connecting to Public-
    Inbox servers (bmo#1786203)
  * fixed: Various visual and UX improvements
    (bmo#1782235,bmo#1787448,bmo#1788725,bmo#1790324)
  * fixed: Various security fixes
  * unresolved: No dedicated "Department" field in address book
    (bmo#1777780)
  MFSA 2022-42 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-3155 (bmo#1789061)
    Attachment files saved to disk on macOS could be executed
    without warning
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Thunderbird 102.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667390400">- Mozilla Thunderbird 102.4.1
  * new: Thunderbird will now catch and report errors parsing
    vCards that contain incorrectly formatted dates (bmo#1793415)
  * fixed: Dynamic language switching did not update interface
    when switched to right-to-left languages (bmo#1794289)
  * fixed: Custom header data was discarded after messages were
    saved as draft and reopened (bmo#195716)
  * fixed: `-remote` command line argument did not work,
    affecting integration with various applications such as
    LibreOffice (bmo#1793323)
  * fixed: Messages received via some SMS-to-email services could
    not display images (bmo#1774805)
  * fixed: VCards with nickname field set could not be edited
    (bmo#1793877)
  * fixed: Some recurring events were missing from Agenda on
    first load (bmo#1771168)
  * fixed: Download requests for remote ICS calendars incorrectly
    set "Accept" header to text/xml (bmo#1793757)
  * fixed: Monthly events created on the 31st of a month with &lt;30
    days placed first occurrence 1-2 days after the beginning of
    the following month (bmo#1266797)
  * fixed: Various visual and UX improvements
    (bmo#1781437,bmo#1785314,bmo#1794139,bmo#1794155,bmo#1794399)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1667563200">- Mozilla Thunderbird 102.4.2
  * changed: "Address Book" button in Account Central will now
    create a CardDAV address book instead of a local address book
    (bmo#1793903)
  * fixed: Messages fetched from POP server in `Fetch headers
    only` mode disappeared when moved to different folder by
    filter action (bmo#1793374)
  * fixed: Thunderbird re-downloaded locally deleted messages
    from a POP server when "Leave messages on server" and "Until
    I delete them" were enabled (bmo#1796903)
  * fixed: Multiple password prompts for the same POP account
    could be displayed (bmo#1786920)
  * fixed: IMAP authentication failed on next startup if ImapMail
    folder was deleted by user (bmo#1793599)
  * fixed: Retrieving passwords for authenticated NNTP accounts
    could fail due to obsolete preferences in a users profile on
    every startup (bmo#1770594)
  * fixed: `Get Next n Messages` did not consistently fetch all
    messages requested from NNTP server (bmo#1794185)
  * fixed: `Get Messages` button unable to fetch messages from
    NNTP server if root folder not selected (bmo#1792362)
  * fixed: Thunderbird text branding did not always match locale
    of localized build (bmo#1786199)
  * fixed: Thunderbird installer and Thunderbird updater created
    Windows shortcuts with different names (bmo#1787264)
  * fixed: LDAP search filters unable to work with non-ASCII
    characters (bmo#1794306)
  * fixed: "Today" highlighting in Calendar Month view did not
    update after date change at midnight (bmo#1795176)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668600000">- Mozilla Thunderbird 102.5
  * changed: `Ctrl+N` shortcut to create new contacts from
    address book restored (bmo#1751288)
  * fixed: Account Settings UI did not update to reflect default
    identity changes (bmo#1782646)
  * fixed: New POP mail notifications were incorrectly shown for
    messages marked by filters as read or junk (bmo#1787531)
  * fixed: Connecting to an IMAP server configured to use
    `PREAUTH` caused Thunderbird to hang (bmo#1798161)
  * fixed: Error responses received in greeting header from NNTP
    servers did not display error message (bmo#1792281)
  * fixed: News messages sent using "Send Later" failed to send
    after going back online (bmo#1794997)
  * fixed: "Download/Sync Now..." did not completely sync all
    newsgroups before going offline (bmo#1795547)
  * fixed: Username was missing from error dialog on failed login
    to news server (bmo#1796964)
  * fixed: Thunderbird can now fetch RSS channel feeds with
    incomplete channel URL (bmo#1794775)
  * fixed: Add-on "Contribute" button in Add-ons Manager did not
    work (bmo#1795751)
  * fixed: Help text for `/part` Matrix command was incorrect
    (bmo#1795578)
  * fixed: Invite Attendees dialog did not fetch free/busy info
    for attendees with encoded characters in their name
    (bmo#1797927)
  * fixed: Various security fixes
  MFSA 2022-49 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Thunderbird 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Mozilla Thunderbird 102.5.1
  * changed: Mail extension API updates. See Mail Extension API
    Docs.
  * fixed: "Copy to &lt;folder&gt; again" menu item was not present
    after copying message to folder with Unicode name on Unicode-
    enabled IMAP server (bmo#1798172)
  * fixed: Calendar date picker was displayed behind "Send Later"
    window (bmo#1791537)
  * fixed: Various security fixes
  MFSA 2022-50 (bsc#1205941)
  * CVE-2022-45414 (bmo#1788096)
    Quoting from an HTML email with certain tags will trigger
    network requests and load remote content, regardless of a
    configuration to block remote content</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670932800">- Mozilla Thunderbird 102.6
  * fixed: Importing secret OpenPGP keys failed when public key
    with public subkey was already present (bmo#1795698)
  * fixed: Message index files were incorrectly deleted when too
    many folders were opened (bmo#1787609)
  * fixed: Thunderbird sometimes incorrectly formatted synced
    vCards (bmo#1792542)
  * fixed: Recurring events did not display past a certain number
    of repetitions (bmo#1789437)
  * fixed: Cookies deleted from the "Show Cookies" dialog were
    not actually deleted (bmo#1803795)
  * fixed: Paused RSS feeds did not actually pause updates
    (bmo#1789120)
  * fixed: Various visual and UX improvements
    (bmo#1800189,bmo#1800537,bmo#1801080)
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Thunderbird 102.6</changelog>
</package>
<package pkgid="b384ee28e49f0b8977a71c2c199f7f8fb56174be9b16dfc14616d6b14e8f95cc" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="e9355e8410a074d2aa49336754cf80cfc7b727268dbb46bc59830ee0320d102a" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="f91eb9225dd23e696c014c5c6f6c5be73e58d5659d6eb606af5efe1914cf699c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="e6689b71b75d1902cc21df80ae874b467bfeba0aae742d57672000dcc166cbf6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="ddc034e1387ec0f3a274961766b00d1afbc98e51dea288a48ce9edae104b8556" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="65a861a2562c0ae29afda9d144a7ab81b127641e9c89565ec721aebbc156f51d" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="1c6acfbd5a3c17788616ef5f0153198fb5576e99cbcf3f51eeb0ca73521930a0" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="74c9fd975001d30cd785bd68ef77c700ea5a31a803d75cb3ac2afae51404a9de" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="fa56187df86f58759ec24236b73676b5ea2ba8b980fce0dc75ec49b4f875769f" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="ca53a36767b3692c21f3005b5117a0c32cea22e1c197b57c0625297eeb111c26" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="32394d0df7b96a6c82a10e5a57d230a18dbbd6f1644f10acbc103cc569be9916" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="4697b3e1587524879e06e0e206fd9f4188a778496e12756e7c169262ce589d78" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="9fb52c0da6defe6e076acd31a5eed2aab4d4661ec83a5d7a3458e557be3aa292" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="fa0729bdf5938f47a40ec42b0fe049125dab2fb908f69ff2d8bf0e1a1273853a" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="8e6e4b31496479994052c9eb01d7f049f158df23cc6b1d5b88f2d3ce2c3efdef" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="84faa5270cdeca9108a14ff4eb7bc9dab2e8885a498ab73071433235d5021162" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="d06ff813e0e034ab04d5181986437a944d33a272eb72124cdefd958b46eaa71d" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="3ec19a72fd7a2e5a5e2efff04ca98e506919740c492ac599c49d58755304eaae" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="8241bef3222998a27f3ebcb0e5137a30e1fd860462e8c2863379f0155e20611c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="c196d9d98fae3d482e56856635e0a6d1c0f90b9728e1cb94b37680070e3eaee8" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.10.0" rel="150200.8.73.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
</package>
<package pkgid="b42c29e77ca6a4931c9fb902ead5837e4b74f397e01e3a278ceca9e45c27c5b5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="62dfb3b0cd00cf222e4218c07b768d57c6ca03db1f36617db8cac47db0283a59" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="e59a7fdbcfffd793c2739271a72af098b9ecc8cbdfec29b4a9df7dacacfaa9fc" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="9566330ed8be1b160e56f5ff3a66b6a554b42d40b88e95d6aa3b40fed8fcef59" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.11.0" rel="150200.8.76.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
</package>
<package pkgid="947957714cc18e53b843e4470f7d25d6201de73654fa2a07df9e82bf880eb750" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="c2ce9a5cd2875fd46ff3847875e85de495cc9a80ca9a6e8b8b06973d428a0ac4" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="13e4732151dd05a798b3a6578ebc4ac03e03410fb95555f02a7e73a99bf5802b" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="12989326943abcc476eac0441d818d3dd46fa6784593b05620cdebcca1d6bdf0" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.12.0" rel="150200.8.79.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653307200">- Mozilla Thunderbird 91.9.1
  * fixed: Various security fixes
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654084800">- Mozilla Thunderbird 91.10
  * fixed: Various UX and theme improvements
  * fixed: Various security fixes
  MFSA 2022-22 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-1834 (bmo#1767816)
    Braille space character caused incorrect sender email to be
    shown for a digitally signed email
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Thunderbird 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1656504000">- Mozilla Thunderbird 91.11
  * fixed: CLIENTID fix for bmo#1759197 in Thunderbird 91.8.1 did
    not work; additional fix applied
  * fixed: "Save-As" attachment dialog did not have filename pre-
    populated
  * fixed: Various security fixes
  MFSA 2022-26 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-2226 (bmo#1775441)
    An email with a mismatching OpenPGP signature date was
    accepted as valid
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird
    102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1659096000">- Mozilla Thunderbird 91.12
  * changed: Support for Google Talk chat accounts removed
  * fixed: OpenPGP signatures were broken when "Primary Password"
    dialog remained open
  * fixed: Various security fixes
  MFSA 2022-31 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
</package>
<package pkgid="493d63c7d3dbfa4e0f92609c8abba8fa02bade0618caf2e6345c211ab0e9fcad" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="ae87c89da606dcce5b4ccf89d032e59bb0b09b32ca451ed8fc617c3192bdd78b" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="d6a79ab061fd76dd77b9068af255b9544449b2223fa0efb921eae6e481e50061" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="6450250883e31181ccd99bfa02a0a369b0de5444459ff4af420beabd940faef1" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.4.0" rel="8.45.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
</package>
<package pkgid="13f46131676e8646195dff167b1fe2803d6d0f5f9f31660cd8ec1c1f8907e7ea" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="db6d4eb76d0e577dc03f2b4b6de81f32a7eedcc0a802bb58534b6b2bc06c328a" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="df771e91316ce0518229a55c8d715701ad1d9466b495c27e9bf804eb694818a1" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="33ec5e0c6051979ef978104cb9314ad684fb0a0690e2b83f4d581abfe7558bc2" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.4.1" rel="8.48.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
</package>
<package pkgid="52da41327a8f7370d1419377399d56be3deda8001a2c147fe396f4ed218fe401" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="7356ebe581a7443e9bc56e7ad489939c303cacde872cb4108f07217927aeb624" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="4854631f1e5b809b47eb23a0e6643aa9cd5edd5ba73f057ed11e6e0929c243d7" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="92d9f8178570590c0f76d644041caec94bb390334eef17028c644150063a1f07" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.5.0" rel="8.51.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
</package>
<package pkgid="753cae5b156324a044779861e9202c3010f2143762e602785fa37a22f9def831" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="6c57e6043aaa533d6dd112abb43abc11c0735b9e7408eb4f8d46a457ec114e7e" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f6c56882fc310a67faec120d5f975644423676a608dfb6bcb29bbde4bb60f63c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="1620ee6c6777f259ef42da0378a1c91e773ed09d9efe43e7120b23527d8fb315" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="e3222eac31cd4da477d5aec3f47a3d4082f24228b6223299d0d8e53e282dacc3" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="1e9b3afb80b9d7f016e7fd32f7707cc47e182a958c7f2196c60938de5e2a857c" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="95986b9543b32eac0cf6e4cfe0ec4ba42c6f4b35e216ba45dfef2e41489b7083" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="dc51078a20802e39e5c72bfb16fb9f49372af03269d76bfd095161f9eb1b4acd" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.56.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="20ee6da3aa3659acd645bb3735e3af8a37a54d8daae16291a42e8455cd2e061c" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="406471cd93773d9b1d7e8bf1d9ca0068317413e6127f8eda53391b49ee1e6734" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="d3f2c9c723dcfbee953ad8311e1d3145edcee175737154131db4d77e857000c4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="4c1769abccf1dc9b729274b10f964da54137a0c01ca91a2ae01f7e9b9ba3c043" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.2" rel="8.59.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
</package>
<package pkgid="c6198941922b7113361427a24d6f5ac8f2df73c89eb199927b87252ff1edf719" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="8d9210498341b10a1c8542b1579cd6308366f434fe94a7b7da81cc11a86a7d0e" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="e86dbccf440d4b416b2cba120056e481405385429bb2366b65b5ee9f99fd3a12" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="7f8256020f0cdd916c78b508bf4e11dec58d7cec52379874d7e6a0318c27ed3e" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.7.0" rel="150200.8.62.7"/>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
</package>
<package pkgid="4e9417418e4b26bd79e38dad011760e42cba07a079835affcf3a1a060aa5e92e" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="666be838b73cbedd980bc9a070ba3767e65319a1404d48fbe0726943ab2b39f7" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="cf93e002dcbd02e54511eb6651239dc78674499d3552070bbaca0d88a13c4f6e" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="a4ef57ee293524362441ae674b3add8270f3eebc55851f6485cd4b41b79e42ad" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.8.0" rel="150200.8.65.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
</package>
<package pkgid="d99502b15e4e9afeec3835f15629716b9aa7488cab39c165b883950c385f9f1f" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="1b609ff558fd1027e34310e0484f7304775df8765a1855aa06a7dee252548d9c" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="c541ec95f7de8b5802fd591183649cb89069c0d79eb70a49c34fad6f6c2aee7d" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="5467b6f85214086ba9867aebb90175b4b4aa4cd6e7646fdf7f1389adaef3f9d5" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.9.0" rel="150200.8.68.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
  <changelog author="cgrobertson@suse.com" date="1646740800">- Mozilla Thunderbird 91.6.2
  * fixed: Temporary files from opened attachments were saved
    with world-readable permission
  * fixed: Various security fixes
  MFSA 2022-09 (bsc#1196809)
  * CVE-2022-26485 (bmo#1758062)
    Use-after-free in XSLT parameter processing
  * CVE-2022-26486 (bmo#1758070)
    Use-after-free in WebGPU IPC Framework</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1646913600">- Mozilla Thunderbird 91.7
  * changed: Thunderbird will use the first occurrence of headers
    that should only appear once
  * fixed: Auto-complete incorrectly changed a pasted email
    address to the primary address of a contact
  * fixed: Attachments with filename extensions that were not
    registered in MIME types could not be opened
  * fixed: Copy/Cut/Paste actions not working in Thunderbird
    Preferences
  * fixed: Improved screen reader support of displayed message
    headers
  * fixed: Various security fixes
  MFSA 2022-12 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on
    signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26386 (bmo#1752396)
    Temporary files downloaded to /tmp and accessible by other
    local users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build TB.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649419200">- Mozilla Thunderbird 91.8
  * changed: Google accounts using password authentication will
    be migrated to OAuth2. See KB Article.
  * fixed: OpenPGP ECC keys created by Thunderbird could not be
    imported into GnuPG
  * fixed: Exporting multiple public PGP keys from Thunderbird
    was not possible
  * fixed: Replying to a newsgroup message erroneously displayed
    a "No-reply" popup warning
  * fixed: Opening `mid:` URLs on macOS failed
  * fixed: Address books stored in older formats were loaded as
    SQLite files, causing a crash
  * fixed: Replicated LDAP directories were lost after switching
    Thunderbird to "Offline"`mode
  * fixed: Importing webcals from the commandline failed if the
    URI ended with an `.ics` file extension
  * fixed: Various security fixes
  MFSA 2022-15 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1197 (bmo#1754985)
    OpenPGP revocation information was ignored
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Thunderbird 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1652097600">- Mozilla Thunderbird 91.9
  * changed: A warning is now displayed if an OpenPGP key has
    unsafe attributes that are ignored; See support article.
  * fixed: OpenPGP integration in Thunderbird 91.8.0 and 91.8.1
    did not allow SHA-1 key signatures
  * fixed: macOS disk image graphics updated
  * fixed: CalDAV calendars were marked read-only on startup
  * fixed: Task creation field on macOS incorrectly displayed a
    search icon
  * fixed: Various security fixes
  MFSA 2022-18 (bsc#1198970)
  * CVE-2022-1520 (bmo#1745019)
    Incorrect security status shown after viewing an attached
    email
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29913 (bmo#1764778)
    Speech Synthesis feature not properly disabled
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620)
    Memory safety bugs fixed in Thunderbird 91.9</changelog>
</package>
<package pkgid="e2484ba3373dd6f0a6b783f13972b59d04a7cbdb7469633fdb64026ceb3bbffb" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="e40d4c70ea5b3fb762ec1d1097010e9e40c27b06ca2dae63da26f5d6b26a3e5f" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="4beb0d419d77f8f47269bf617756e78cc35095a3c594b770fca156876d6e78c3" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="5cae9405616801f31c25755aeef2227f4696bd3d9534ccd58ea36f13902822c5" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="65b43d2dfe9be21087f982e4e65ca17ce3c4bc5bd770efdc37ff5d0d64ac9bff" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="c2832661dc3e5d4aad9f52de3ca6f0fc44850c09c7bf34aa5301b633db3f2fa4" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="b43eba6fdca2047be2b0c653f136233a70af898cafff10b26bbef452e4e53977" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="9e1619a9244b892360fade068fa008645db58702e9d5e168e93b2d890d91ee71" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="8ca243b94813c8726ac885a6116cee0419bacaacf1d95a77eff329431f894c37" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="0bf51fa7e1c413b423437aefc0de295852aff18b05b30e839bc8e8762908ec66" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="28ffa7b1bc90d8114d32927bc3348553d197dee27f341d6132d1af4f3af4de2d" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="451113bf3b658171408b27f98f4efec66105f11b5ebf7f66945761541bfcdc8a" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="18653e9e2eb6a4c0c095878acb3eb00b50299827da3c5b2a4d4900a148a3bf98" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="5e62ef1ba63d2ea3bfede10a3ad229dff01539f267173caa2eb4612bfe3feb37" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="097db9f921e12bcb1d4ae081a431d54df9f14046235d3d2fb848b0d07d56edf0" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="0e56625fcde01906674c09b80645f3f7b3547feed141255f93a72b6feaf01eaa" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="2b631289252dd5699edb4ef8c3d7fa79e38ca79c7615db7920e59101be9e7984" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="251edd8f9cba0252a04ce59a30eaf4cf371c7c73562ced5c547a4d2b77a45f28" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="c8c8a6c13f016dd751c407919f23cb967cfa24ddc6c5ed4e112b78503fef4ba9" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="2328af754b318c89826fb33439d7c7485bc7fcd3edd563a9b8c27b1fd6bce5a3" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="7567d920ee2927d306d8505d5b016ad0ac8178f69b87ff144c40083a2e428de8" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="3a83bf35060fcc127b3c225eaa778dce74ca6d6c7c96faa16dd187e2ef07e34f" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="de05f2f687fec1812dc7c202022baf41bbf7ecfa0428072db9476e811b99535d" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="7aeae71cc6e0af95db1c7d371ea364f925fb259d8eaab6716cf1a6c095855af0" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="cc304261c6626945b56ae696ce7b8dbfb11eba6bf9b7205e2546b9f2fe3b0e42" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="a1cf63bba055f858dda177fa37da9e4f13b802568f02308117fdeda726736c49" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="b50f2421af8a783fe01c9e05da019fb2b796847eb53956a39d4af25b8001b757" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="d5dcbdaa39bc3c0ebefd8c59aba44a32ea6c817c651ea41aafb506665ba47d2c" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="7f46e3af834ee1c3e345df7a08716d033af54f03ba64d610e2e186309d2ff941" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="74b8359bc63dcf6458dde4544a777b814e2610693b943497728ea02500d646d2" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="77d31d0bb41ccf19342c1b3244c1304e8baa0b11f1668b45d3bad615d1f5132d" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="3cd897cc8bf5e40585be72c1d088c5677c4d51a41a860882a887962e70a6422a" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="00e97a7ef391d8ead6bac561f1d2a91658946d8dbabb416512f017087baca879" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="f6878c09878213f16cd8677cdbdd88b9386222220a9575403761b8204a449e5c" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="150200.3.15.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
</package>
<package pkgid="33324d9e027b7c0e213fdfeed011e0c4c27c6a44f3abff300e55a5b3e19fc073" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="150200.3.18.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1646222400">- Add NetworkManager-RFC8106.patch: Backport upstream fixes to
  implement RFC 8106(glfo#NetworkManager/NetworkManager#874,
  bsc#1195173).</changelog>
  <changelog author="petr.pavlu@suse.com" date="1649332800">- Add 0001-rdisc-fix-parsing-ndp_msg_opt_dnssl_lifetime-from-IP.patch:
  rdisc: fix parsing ndp_msg_opt_dnssl_lifetime() from IPv6 RA
  (bsc#1195222).
- Add 0001-ndisc-don-t-artificially-extend-the-lifetime-of-DNSS.patch:
  ndisc: don't artificially extend the lifetime of DNSSL/RDNSS
  options (bsc#1195222).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1650974400">- Add 0001-supplicant-interface-Match-more-ciphers-to-determine.patch:
  supplicant/interface: Match more ciphers todetermine AP security
  (glfo#NetworkManager/NetworkManager/commit/e0191320, bsc#1198381);</changelog>
</package>
<package pkgid="d328ded46b25bad3ff7f05f5c41c09567e7b2b78a3a8e7e329aa3cefd3ec2078" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="0e662d9232cf0edc80b3770666c4f5af374e070414b07e112aa568284f7cbc5b" name="POS_Image-Graphical7" arch="noarch">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="6c32c5b9ae232924fcad4e3651a752f00a3c6f7f3e9cba0bd7cfadbd2dafd118" name="POS_Image-Graphical7" arch="src">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="da424b0de121648cd4edade09f00f9ed51ac418b8ea5735ac319bb83d96ee5f3" name="POS_Image-JeOS7" arch="noarch">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="7ce49fd4b33dc2d83f8988abda4f7f7b003cfb49a6c3c6123e5e4d5e1575010b" name="POS_Image-JeOS7" arch="src">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="18f7363a50d3f670e5a80f4cef89fc32aae6cae0aec883c766e6f18b5a55cb1e" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="ee3016b2abb97995a7970c9045ea7e45736d4ea65cd8e69258dde98ed41398ce" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="244f77e95e47c3776a62ce564735e68d78490891e186e09b4b3de56f5bcdd32b" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="4c0a9205273843a5731f045340b893894531d788e7e7917d4a0a19a4579b3365" name="PackageKit" arch="src">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="3218b511c7625eee99b2cd050c2bf33408683d1853ce240f7dd8b0c8e655497c" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="e9cd953afd62942010bf96a595bbeaa2cf30eb11f64adfe2bc39f6104e4d5e96" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="4a2db1e4eae6d408ccae4879a491ec8e55480d1bc5e737221e098889ff000506" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="a64adbc3d719d4bbbfe39a8653950516f3f0f649542b4e0c1deba8697e13f0c8" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="cef055595ba8f1c619cf4a85b69f021216dc3f9a7f7322288b7bf3cc9ded936a" name="PackageKit" arch="src">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="d50e53630da21fec51cee81cd1c53a780380e28a260dabbbce9b5f4aedb222e5" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="95bc860fb6d6263bfa5ccd4a7e6a91dbd5c792ec5e4410f33a43e69c5e6f36fd" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="419df73596a417e93152d9da635bf2823e8e1bce25df3eeb102b3f1ddc6ddc94" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="baf60ff0b2845410d44d3e6dfad554cdd267c9e1d69012d53fc5ccc410cb2cec" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="5198178d941a270d0863102b80464013a616cc85485fad3752587c753e11e23d" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="dcab01878e959bb52c44ae76ae06fd02947cbd945e4d5e8c8aa700b4a2b65349" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="63e708dc1fce49f2065b5c32ef0f2e21b8ed95e36e8a9af4b25b94ecded4a3e6" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="7da023ffc3a7b3d177aa7f3f55617084279d59c2b0caea6a2f343686b5aadd2b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="9bbddbec88b97ee3e899c3857127448969b1eb445aed89b9fef17e86a0ee9e32" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="e2a58677a6568541118131ef7c99ee1879b14acea8ac8a004fcf24a5889b8811" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="b5719307fd3c3aba85749d9265541b929435134c67eeb843fd4ee6fcdb96518e" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="274e9f6f64df745437785ab5a57510cab306846231dad6d2c8b5a89222e2b626" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="889599a926007207e1bcdb3591847ca82b59404aa6085ce57dc660c4ee7bd2ee" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="88e9f7ec441d6d01b7da961b82710a037e6effa5d443fd8067b510a2b0a71626" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="e5fe007c55115c9ba1f6041e5d13482143528d69a552aa7e18d846b6b0b706c4" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="797093243e7d21be48d33e93f39fbdfe3f189433313503b05cf759ee5457e6b0" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="ddd606831e2f235ef3b7418b9c3a63a9047b917f4093f5e9a36dec9d09ac5f96" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="62dc37a04768783381422311d407c9cfca2aa0539a1eab00e2bd890f939afb30" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="7e1b055d55f33b47ebabd17989b57adacb004945e6cacb5b8e52cd28406e5d77" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="41dedceb8363b4376fc9f6f16a8cbdcb866afbc0ea16e8cf598c9ec1e58c8f85" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="51c9358bb5cc4631ee1ec9c8cd0bed6ac334023d6364d83cdc7851ec3135c2bf" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="2f6a4a5aed9118fb4af28adf4fdaf81b77397f0514bed45afd4af075c99605c9" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="3f3cc5716a6338e2ba8e9b06fe1b99c22eab7be989eb55dbf4329706982b3d9e" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="dce8b5876d78addc196ce2761edd9a771317d849f1213caf9530f4fb472036dc" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="9f4f3548fe952774ebe515b2fcc2f9f4871838ac1622cd0a701be85a2c7bac4b" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="816d0c9456657a61bcac4d92e922ddbfdcfbcc46c09b79eed412d7e1f53202c5" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="71ab83170efd299d5d0032cb8065517cd0b95b39f0b46a09e4e3a499ec90a817" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="515df0137e58a665e5a1549922d88a09e0f33de3a5f52787c8881e54bd6d8ed3" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="7b67baa3c079ff867f54fab924effbfc35005b575b9a55bc9a0f4d37b2d5dce7" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="6313e01f321d5da2199b5ca1dacf9af6d7b62f11ecbfbbdadb397d1929b0fcc0" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="e45b1a03d5999f9644ce8f4e189bb17fdd9d9871c823ef6757eb144a3e6563fe" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="c3ea28f039061672ff3667bb5d28c582442db60e23e0856511d149ae970483b4" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="5c8d135bff522d5729c4ecd39b6ea43c23ad7a6f484a66640711231d89cacd91" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="233282a2edd96034713daf6cd962c3609b1fbcc2ef4e3f09c2f7781f36f1cd19" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="d9a5d5a1e7ce6b97490386d169f0c349f9d88cb739a66c230b4945f8f855fee4" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="92a88b82fb2aaa64b2ccaceb122f00d8e89e6b035391a034b629f7be2d747377" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="ed49335603e1619e6fcf1002e4e79ecbbf617b60592fa131df9046164cc4ab25" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="f681f176c1658ffa55923febd935a86c4f96bb04ff8e52add6cec86fd40dd038" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="f156db1b6912d0bcfb517aa3dbda992cf435c5b223e8d71622e60b9985ed45e9" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="bc742e38fca5a9fecdcef0d1399e4b6695c99678c76bc5ff22629c98aecbd49a" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="149a8779a6a39a33e2e84d9dd97052dd370567e35ad9f38763135d293af73c31" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="6a5dcf6f924282b43e3e46c24714c7915c6874dcdc7732b9f09f12da884aa803" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="1be72363506082a9a58d004de8086af2185cb041a1963eda2ea2778c7124dbf0" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="1145422bfb6aae23f6460f38b5193ddcbbd06e77a02dd2b84fc6da5c04ad396b" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="150200.4.26.1"/>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
</package>
<package pkgid="48282598a298139590dbd2be5cbdab9558bcba087310dd493d25e59523291772" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="6f2c2fee86d53b0e26b3fcacb6b88742042f6762b108b24436c929143b5d69da" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.155.0" rel="4.17.1"/>
  <changelog author="fabian.herschel@suse.com" date="1462276800">- log_attributes are not longer logged to /var/log/fhATTRIBUTES by default</changelog>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
</package>
<package pkgid="a8225120f01bbf63d09fb6e8d72811f6eba0ab6b07660f4741e749e724e837b1" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.155.0" rel="4.17.1"/>
  <changelog author="fabian.herschel@suse.com" date="1462276800">- log_attributes are not longer logged to /var/log/fhATTRIBUTES by default</changelog>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
</package>
<package pkgid="a4dd070c14c4fb3bbd4bfbada111bd5e79e99c106ba8fc3e7579f7348890c4be" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.160.1" rel="150000.4.20.1"/>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
</package>
<package pkgid="87fbc6671e4a98b15b3b3b20d0dfd3fd690c3c6f2a475ac9ebbd545262048fcc" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.160.1" rel="150000.4.20.1"/>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
</package>
<package pkgid="61610c465234f3f6f35304eb90316969947f70cf1764e3513e04b6ecf7aebe9c" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.161.1_BF" rel="150000.4.25.1"/>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
</package>
<package pkgid="abc462354ccc1d23b138138b65a3dd21f532d70095ab5e0bf336fa48c4909b93" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.161.1_BF" rel="150000.4.25.1"/>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
</package>
<package pkgid="4a112da3970a524e1d9b5b6e878b332e74579d988253b856da5d55ecc7f4605e" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="3a4a20b965ebbf83463fcc6ee7a9a27e2649a51145ff465b883f1c8e7fdeb652" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="bddf7d2cd1fa28f18348061e6113c204cdeab7c75c58d1defdfc1d4c163af058" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.181.0" rel="30.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
</package>
<package pkgid="d8152c6ac8852a30532c28802a552425b31704606b03d8a6dbadc66544991cd5" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.181.0" rel="30.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
</package>
<package pkgid="0cf057edb0e1b2f3967208c7850d7731c8011ec5dedc3753e46c7710951ba77b" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="97545b3ec0fbdafd1f58715b77a50febc9d8186711ffc8c651c8cfd4699d386a" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.181.0" rel="30.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
</package>
<package pkgid="e176ba37840e479301f6a07a9d54c97763404886da79b88e5a0d5302f300b044" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.155.0" rel="4.17.1"/>
  <changelog author="fabian.herschel@suse.com" date="1462276800">- log_attributes are not longer logged to /var/log/fhATTRIBUTES by default</changelog>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
</package>
<package pkgid="45a9a83161f2384e709d8f83cba3e3b388937a08b1d9036b894f37280de48aba" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.160.1" rel="150000.4.20.1"/>
  <changelog author="fabian.herschel@suse.com" date="1464782400">- bsc#982355 - SAPHanaSR: SAP changed the interface of landscapeHostConfiguration.py beginning with SPS12 rev 120
- bsc#981446 - SAPHanaSR: SAP revokes interface hdbnsutil -sr_state beginning from rev 112.03</changelog>
  <changelog author="imanyugin@suse.com" date="1478088000">- Version bump to 0.152.18
- Fix bsc#985474: SAPHanaSR-showAttr shows node ID instead of uname
- Fix bsc#1007825: SAPHanaSR-showAttr fails to show node status
- Fix bsc#1005872: SAPHana Resource Agent handling virtual hostnames
- Fix bsc#1007605: SAPHanaSR no longer ignores DR SR status</changelog>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
</package>
<package pkgid="9b0e37d9ebbe1eea0466962702451e8b840f339b392e9290b9f425eee03516c9" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.161.1_BF" rel="150000.4.25.1"/>
  <changelog author="ilya.manyugin@suse.com" date="1482235200">- Version bump to 0.152.19
- Fix bsc#1014397: SAPHanaSR not failing over consistently
- Fix bsc#1008469: SAPHanaSR-monitor reports wrong status colors and error messages
- Add a cluster attribute hana_&lt;SID&gt;_version upon a probe of SAPHanaTopology
- Update man pages
- Change the Setup Guide to contain just the URL to the best practices
- Fix bsc#994753: Tool SAPHanaSR-showAttr fails to read offline cib file correctly
- Fix bsc#1016691: Status file of SAPHanaTopology is not multi instance aware (MCOS)
- Fix bsc#1016936: SAPHanaSR-TestDriver fails to detect the correct status
- Fix bsc#985822: HAWK Wizards are listed as legacy</changelog>
  <changelog author="imanyugin@suse.com" date="1487160000">- Version bump to 0.152.20
- Fix bsc#1019117: Fix master scoring of secondary during a takeover</changelog>
  <changelog author="imanyugin@suse.com" date="1493812800">- Fix bsc#1034685: SAPHanaTopology fails once after updating to 0.152.20</changelog>
  <changelog author="imanyugin@suse.com" date="1495800000">- Version bump to 0.152.21</changelog>
  <changelog author="imanyugin@suse.com" date="1496404800">- Fix bsc#1042154: Scoring race condition between SAPHanaTopology and SAPHana</changelog>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
</package>
<package pkgid="82cc5913f59b3a449d15f592d22cb95ad72b3bae548170586bf51a48485d3acf" name="SDL" arch="src">
  <version epoch="0" ver="1.2.15" rel="150000.3.19.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1370692800">- sdl-lfs.patch: Ensure library is built with large file
  support/ 64bit off_t in 32bit systems</changelog>
  <changelog author="jengelh@inai.de" date="1376395200">- Some metadata spruce-up: add current URLs, softer wildcarding
  in the files list, more robust make install call
- Optional signature verification in local builds</changelog>
  <changelog author="jengelh@inai.de" date="1387281600">- Add libsdl-1.2.15-resizing.patch: resolve an issue whereby window
  frame corner resizing emitted no resize events to applications
  (bnc#855639)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401019200">-  Update SDL-lfs.patch, after a recent verification I found
  that something is not including SDL_config.h (config.h)
  therefore not using large file offsets.</changelog>
  <changelog author="dimstar@opensuse.org" date="1413115200">- Drop esound-devel BuildRequires: esd is really no longer the way
  to go.</changelog>
  <changelog author="jengelh@inai.de" date="1418904000">- Remove gpg-offline leftovers</changelog>
  <changelog author="jengelh@inai.de" date="1418990400">- Drop old soundserver support (also arts, after esound).
  Remove --with-pic, building defaults to PIC anyway.
  Use pkgconfig names to slurp in packages.</changelog>
  <changelog author="jengelh@inai.de" date="1420545600">- Avoid bs_sched computation failure by expanding %power64</changelog>
  <changelog author="schwab@suse.de" date="1421064000">- libspe2 only exists for ppc and ppc64</changelog>
  <changelog author="schwab@suse.de" date="1498737600">- libspe2 doesn't exist any more</changelog>
  <changelog author="qzheng@suse.com" date="1550750400">- Add CVE-2019-7637.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7637, CVE-2020-14409, CVE-2020-14410, boo#1124825,
  boo#1181201, boo#1181202).</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="mgorse@suse.com" date="1566475200">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).</changelog>
  <changelog author="mgorse@suse.com" date="1649160000">- Add CVE-2021-33657.patch: always create a full 256-entry color
  map in case color values are out of range (boo#1198001
  CVE-2021-33657).</changelog>
</package>
<package pkgid="53baad9df5e8359a0c7c2298578219ef619990223c94b168e2b01e8506ebda93" name="SDL2" arch="src">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="aa7c0f1fcee7c415b2908bcc97373277efa2b5a71c44f8a84901d11172c92f69" name="SDL2" arch="src">
  <version epoch="0" ver="2.0.8" rel="150200.11.6.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
  <changelog author="mgorse@suse.com" date="1649160000">- Add CVE-2021-33657.patch: always create a full 256-entry color
  map in case color values are out of range (boo#1198001
  CVE-2021-33657).</changelog>
</package>
<package pkgid="31bb9020fc1b8b49846d1baab200f2c91d7c3c01733aab4d40d9d77630928d9a" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="c14569ff6ccf20cc4349779a18d972ce0126deb8b8eba86d4eb5edc90a596ddb" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="96b29c0ea068eb2a2bc7916161a722ea2ffcda191fff7ccd5ee5aa3089ed6eb1" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="a11017d7d4b55f4de1c2e6e26c621c2486f5849520a3e53ed0bee79ddd5e6dc7" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="62bd331fd9bbf335858309f4d92328cd4f782aa0b88522cd08354fa793e1507d" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="55a65ad689de3b9405a35e8776897a88944081ea350a5f335093c02d71db1e77" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="fb678f51d9ad62bdad3908f4fbe7911e62a11ebc172f02f17cfce5c7540b02be" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="e4f21dd3b9437725a0520167d1e5462f0f0b1ba49f3871e1ace14092ce4495e7" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="a20a326e04ddbf685cb53f7fc29dc8339fca922eb495d440c4414026f680a07a" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="4326ef2016a4ccfa2216c7652452becd2c8b6ac20508af00396e550e6706780e" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="e0ba1f9bf13fd82c5005f405dd7c75fde7cac3d3b7f471b81e044b4abd0e53fc" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="d3085c926ffa66a025c8f1a53182e4c7a3514c4e0e50e28bad2bcdfce05a6abd" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="82a516eab771035805ab654d6fb11120da5ec38cf7ed7fa54a9c473ed88a2063" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="35ea57ad1842131c143c519ca43b6395d221e49f41a1f0bcdcdc88665e92467e" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="33fc1e7cb50388102af3a5ff9f6abe490386b609fa641d935bb86014d76db8d9" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="3b60aefa3ef580cef4e7a8224f9a6eef07dfa125145df1614edd48f0b4f6e231" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.34" rel="150300.20.3.3"/>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
</package>
<package pkgid="7f8ac148d790cc8bd24f5620814feb2726a1105fdad4b5525ff0c86d250f11c7" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.34" rel="150300.20.3.3"/>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
</package>
<package pkgid="1334f4a507d6eb94f68810b59bb8caf420b65d87dd07be2f3e2a32cc7c28be0c" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.34" rel="150300.20.3.3"/>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
</package>
<package pkgid="fb3e5abab5dd85717dcc8fba7a1a69011a49666d939772be9d25bee2d3d2924d" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.34" rel="150300.20.3.3"/>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
</package>
<package pkgid="99a38cfd35dfcbc442b2afaa708068eabbac6b3feea12275ce020df2ef5e6662" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.34" rel="150300.20.3.3"/>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
</package>
<package pkgid="2f65a7b64c936677d0020c1be431f57a297e7b1749003bc561171ecd62143a80" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.36" rel="150300.20.6.1"/>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
  <changelog author="ngetahun@suse.com" date="1656936000">- Update to 0.3.35
- Rely on system-wide defaults for enabling the keepalive timer by systemd-presets-branding-SLE. (bsc#1200641)</changelog>
  <changelog author="msabate@suse.com" date="1658923200">- Update to 0.3.36
- Allow suseconnect-keepalive.service to recognize a configured proxy. (bsc#1200994)
- Remove the `WantedBy` statement from suseconnect-keepalive.service since it's only to be triggered by a systemd timer.
- SUSEConnect will now ensure that the `PROXY_ENABLED` environment variable is honored.
- Write services with ssl_verify=no when using connect with insecure</changelog>
</package>
<package pkgid="6a8b4ae8f10ed061d92682bf9ea07319a8c8ffea3dae447b76c4068cc00929c9" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.36" rel="150300.20.6.1"/>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
  <changelog author="ngetahun@suse.com" date="1656936000">- Update to 0.3.35
- Rely on system-wide defaults for enabling the keepalive timer by systemd-presets-branding-SLE. (bsc#1200641)</changelog>
  <changelog author="msabate@suse.com" date="1658923200">- Update to 0.3.36
- Allow suseconnect-keepalive.service to recognize a configured proxy. (bsc#1200994)
- Remove the `WantedBy` statement from suseconnect-keepalive.service since it's only to be triggered by a systemd timer.
- SUSEConnect will now ensure that the `PROXY_ENABLED` environment variable is honored.
- Write services with ssl_verify=no when using connect with insecure</changelog>
</package>
<package pkgid="cb69cc50efad6caca1e73309ec6b4985a0db4009e4c53c46dd8a12cfe7cc6ff1" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.36" rel="150300.20.6.1"/>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
  <changelog author="ngetahun@suse.com" date="1656936000">- Update to 0.3.35
- Rely on system-wide defaults for enabling the keepalive timer by systemd-presets-branding-SLE. (bsc#1200641)</changelog>
  <changelog author="msabate@suse.com" date="1658923200">- Update to 0.3.36
- Allow suseconnect-keepalive.service to recognize a configured proxy. (bsc#1200994)
- Remove the `WantedBy` statement from suseconnect-keepalive.service since it's only to be triggered by a systemd timer.
- SUSEConnect will now ensure that the `PROXY_ENABLED` environment variable is honored.
- Write services with ssl_verify=no when using connect with insecure</changelog>
</package>
<package pkgid="35ecde41e8c1d95fd04f035b125d0ffaf6ae54a6850bdebd7b508a1a78a5ab84" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.36" rel="150300.20.6.1"/>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
  <changelog author="ngetahun@suse.com" date="1656936000">- Update to 0.3.35
- Rely on system-wide defaults for enabling the keepalive timer by systemd-presets-branding-SLE. (bsc#1200641)</changelog>
  <changelog author="msabate@suse.com" date="1658923200">- Update to 0.3.36
- Allow suseconnect-keepalive.service to recognize a configured proxy. (bsc#1200994)
- Remove the `WantedBy` statement from suseconnect-keepalive.service since it's only to be triggered by a systemd timer.
- SUSEConnect will now ensure that the `PROXY_ENABLED` environment variable is honored.
- Write services with ssl_verify=no when using connect with insecure</changelog>
</package>
<package pkgid="5f1d43f8b1e0579457562bef1ec68b4796308054ffec24588e8c1817ec72d8e8" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.36" rel="150300.20.6.1"/>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
  <changelog author="msabate@suse.com" date="1645099200">- Update to 0.3.33
- Add --keepalive command to send pings to SCC.
- Add service/timer to periodically call --keepalive command to make system
  information in SCC and proxies more accurate. (bsc#1196076)</changelog>
  <changelog author="msabate@suse.com" date="1647604800">- Update to 0.3.34
- Manage the `System-Token` header. The `System-Token` header as delivered by
  SCC will be stored inside of the credentials file for later use on API calls.
  This way we add system clone detection for systems using this version of SUSE
  Connect.</changelog>
  <changelog author="ngetahun@suse.com" date="1656936000">- Update to 0.3.35
- Rely on system-wide defaults for enabling the keepalive timer by systemd-presets-branding-SLE. (bsc#1200641)</changelog>
  <changelog author="msabate@suse.com" date="1658923200">- Update to 0.3.36
- Allow suseconnect-keepalive.service to recognize a configured proxy. (bsc#1200994)
- Remove the `WantedBy` statement from suseconnect-keepalive.service since it's only to be triggered by a systemd timer.
- SUSEConnect will now ensure that the `PROXY_ENABLED` environment variable is honored.
- Write services with ssl_verify=no when using connect with insecure</changelog>
</package>
<package pkgid="c0197bd1741d031748781c961a5c99d61a3d9eeab582794c07b3ab653213d43e" name="ServiceReport" arch="noarch">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
</package>
<package pkgid="32511b30ab802173c68c975a9888aec9f753eef8bb4caab94a93d37fd94e1de9" name="ServiceReport" arch="src">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
</package>
<package pkgid="ce114be8ce052177e5659b877b6ccfb057ce2a19f1dbd13ab5e72a6661d39ac9" name="ServiceReport" arch="noarch">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.6.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
</package>
<package pkgid="51beae06c65ba870459ff7b45f2d666ea97c349ff2ef144a6acff781a89876fb" name="ServiceReport" arch="src">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.6.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
</package>
<package pkgid="0106268f1e61164d2d82fd523132a61a73b3a75bee33f4ec6815aba4394370f4" name="a52dec" arch="aarch64">
  <version epoch="0" ver="0.7.5+svn613" rel="150000.3.2.1"/>
  <changelog author="Manfred.Tremmel@iiv.de" date="1250856000">- cleanups where rpmlint wasn't so happy</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1258804800">- update to svn from videolan</changelog>
  <changelog author="ludwig.nussel@gmx.de" date="1277035200">- provide a52dec-devel for compatibility</changelog>
  <changelog author="reddwarf@opensuse.org" date="1299067200">- run spec cleaner
- remove .la files
- add pkg-config BuildRequire so RPM can do its magic</changelog>
  <changelog author="reddwarf@opensuse.org" date="1327406400">- fix baselibs.conf
- don't install the INSTALL file
- change license tag to SPDX
- add automake, autoconf and libtool BuildRequires</changelog>
  <changelog author="i@margueirte.su" date="1415188800">- update latest svn 0.7.5+svn613</changelog>
  <changelog author="aloisio@gmx.com" date="1490097600">- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1490184000">- Add baselibs.conf as source file</changelog>
  <changelog author="jengelh@inai.de" date="1490184001">- Trim filler words from descriptions. Improve summaries.</changelog>
  <changelog author="zaitor@opensuse.org" date="1500120000">- Drop a52dec-compat.diff and mm_accel.h source, not needed with
  the svn checkout we are using.
- Pass --enable-shared to configure, ensure we build the shared
  library.</changelog>
</package>
<package pkgid="7dcd3b3ac0a7c3a21de0750e5b161b181bf090ab3620dfd51d1570e1a0243428" name="a52dec" arch="ppc64le">
  <version epoch="0" ver="0.7.5+svn613" rel="150000.3.2.1"/>
  <changelog author="Manfred.Tremmel@iiv.de" date="1250856000">- cleanups where rpmlint wasn't so happy</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1258804800">- update to svn from videolan</changelog>
  <changelog author="ludwig.nussel@gmx.de" date="1277035200">- provide a52dec-devel for compatibility</changelog>
  <changelog author="reddwarf@opensuse.org" date="1299067200">- run spec cleaner
- remove .la files
- add pkg-config BuildRequire so RPM can do its magic</changelog>
  <changelog author="reddwarf@opensuse.org" date="1327406400">- fix baselibs.conf
- don't install the INSTALL file
- change license tag to SPDX
- add automake, autoconf and libtool BuildRequires</changelog>
  <changelog author="i@margueirte.su" date="1415188800">- update latest svn 0.7.5+svn613</changelog>
  <changelog author="aloisio@gmx.com" date="1490097600">- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1490184000">- Add baselibs.conf as source file</changelog>
  <changelog author="jengelh@inai.de" date="1490184001">- Trim filler words from descriptions. Improve summaries.</changelog>
  <changelog author="zaitor@opensuse.org" date="1500120000">- Drop a52dec-compat.diff and mm_accel.h source, not needed with
  the svn checkout we are using.
- Pass --enable-shared to configure, ensure we build the shared
  library.</changelog>
</package>
<package pkgid="a735bc4c0b6174deb94517fc7b4a2a17752cc88b879f7b0829bef5c100246610" name="a52dec" arch="s390x">
  <version epoch="0" ver="0.7.5+svn613" rel="150000.3.2.1"/>
  <changelog author="Manfred.Tremmel@iiv.de" date="1250856000">- cleanups where rpmlint wasn't so happy</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1258804800">- update to svn from videolan</changelog>
  <changelog author="ludwig.nussel@gmx.de" date="1277035200">- provide a52dec-devel for compatibility</changelog>
  <changelog author="reddwarf@opensuse.org" date="1299067200">- run spec cleaner
- remove .la files
- add pkg-config BuildRequire so RPM can do its magic</changelog>
  <changelog author="reddwarf@opensuse.org" date="1327406400">- fix baselibs.conf
- don't install the INSTALL file
- change license tag to SPDX
- add automake, autoconf and libtool BuildRequires</changelog>
  <changelog author="i@margueirte.su" date="1415188800">- update latest svn 0.7.5+svn613</changelog>
  <changelog author="aloisio@gmx.com" date="1490097600">- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1490184000">- Add baselibs.conf as source file</changelog>
  <changelog author="jengelh@inai.de" date="1490184001">- Trim filler words from descriptions. Improve summaries.</changelog>
  <changelog author="zaitor@opensuse.org" date="1500120000">- Drop a52dec-compat.diff and mm_accel.h source, not needed with
  the svn checkout we are using.
- Pass --enable-shared to configure, ensure we build the shared
  library.</changelog>
</package>
<package pkgid="daf71641ecc69a3a885de7aea912fc1d2e7bdc8ad643ae74dfdd909ec82cc73d" name="a52dec" arch="src">
  <version epoch="0" ver="0.7.5+svn613" rel="150000.3.2.1"/>
  <changelog author="waldemar@links2linux.de" date="1009627200">- first build</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1022760000">- update to Version 0.7.3</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1025697600">- update to Version 0.7.4</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1044446400">- added german description
- some changes I got from Philipp Thomas &lt;pthomas@suse.de&gt;</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1045915200">- added --enable-shared</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1048593600">- changes to use Packman upload-script</changelog>
  <changelog author="detlef@dreichelt.de" date="1101211200">- changes for x86_64:
  - added CFLAGS= -fPIC</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1208692800">- splitted in different packages</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1221912000">- rename of the lib packages</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1250856000">- cleanups where rpmlint wasn't so happy</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1258804800">- update to svn from videolan</changelog>
  <changelog author="ludwig.nussel@gmx.de" date="1277035200">- provide a52dec-devel for compatibility</changelog>
  <changelog author="reddwarf@opensuse.org" date="1299067200">- run spec cleaner
- remove .la files
- add pkg-config BuildRequire so RPM can do its magic</changelog>
  <changelog author="reddwarf@opensuse.org" date="1327406400">- fix baselibs.conf
- don't install the INSTALL file
- change license tag to SPDX
- add automake, autoconf and libtool BuildRequires</changelog>
  <changelog author="i@margueirte.su" date="1415188800">- update latest svn 0.7.5+svn613</changelog>
  <changelog author="aloisio@gmx.com" date="1490097600">- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1490184000">- Add baselibs.conf as source file</changelog>
  <changelog author="jengelh@inai.de" date="1490184001">- Trim filler words from descriptions. Improve summaries.</changelog>
  <changelog author="zaitor@opensuse.org" date="1500120000">- Drop a52dec-compat.diff and mm_accel.h source, not needed with
  the svn checkout we are using.
- Pass --enable-shared to configure, ensure we build the shared
  library.</changelog>
</package>
<package pkgid="33ef1bacfcbaef55f12162503e0f367697e6e0b2474aa3c09671958536bbe73d" name="a52dec" arch="x86_64">
  <version epoch="0" ver="0.7.5+svn613" rel="150000.3.2.1"/>
  <changelog author="Manfred.Tremmel@iiv.de" date="1250856000">- cleanups where rpmlint wasn't so happy</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1258804800">- update to svn from videolan</changelog>
  <changelog author="ludwig.nussel@gmx.de" date="1277035200">- provide a52dec-devel for compatibility</changelog>
  <changelog author="reddwarf@opensuse.org" date="1299067200">- run spec cleaner
- remove .la files
- add pkg-config BuildRequire so RPM can do its magic</changelog>
  <changelog author="reddwarf@opensuse.org" date="1327406400">- fix baselibs.conf
- don't install the INSTALL file
- change license tag to SPDX
- add automake, autoconf and libtool BuildRequires</changelog>
  <changelog author="i@margueirte.su" date="1415188800">- update latest svn 0.7.5+svn613</changelog>
  <changelog author="aloisio@gmx.com" date="1490097600">- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1490184000">- Add baselibs.conf as source file</changelog>
  <changelog author="jengelh@inai.de" date="1490184001">- Trim filler words from descriptions. Improve summaries.</changelog>
  <changelog author="zaitor@opensuse.org" date="1500120000">- Drop a52dec-compat.diff and mm_accel.h source, not needed with
  the svn checkout we are using.
- Pass --enable-shared to configure, ensure we build the shared
  library.</changelog>
</package>
<package pkgid="025ca519338f6aaaa0d5cf0f4e079f5d5ea8107b539c7853bc5fba2ba7e576e7" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="703074d4f11870b6199fc82bde752521d21ad9da0a6b61c43afb796adc76dbf2" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="f1c30f44f104988da7c422b0b2a86d077ca227c64bc3c909c09289715865938f" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="0b01075518f884b372d1f81ea9253bd635cec6b0e0f84e905f2cd2e34b697e18" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="daaa881123df8f47e6826d9de28473dbb9887076df26a6f68fe008f1542a0a02" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="6906799bf519d16369182bb3d5134c66b3ac56f03152388daedb3eb5f07aeaec" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="48e3e71faed04499f169556614ffddec368684b989045a38551934bac736c6ff" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="9ebe550c994ce87619da5a47c037f73e8cd3fbf0a48f5b6c71fe88857362c04f" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="901fbe9d721155c8b8493d7148dacf87d697dc09da41f8770eb503c28547fb7c" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="9672a6a4144d02267306af3d77085470be77f6d890620a640ae67b79ef448d12" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="c4a965585c154d4a94d78d7802fcb5aacb43c1f4c58e45b94e321c0adc94b0d0" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="1063212bc09c229a1a9edfb4f8d2dd2cedf97bc8836f1b36d440840d4aaec4ac" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="4c53603a98b2b94b6b4b0cd8462476e80d0204387300c230d36a585c60d4efda" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="3268de4df06da5b7d620bd5c475a9db6cf4404abd7e3bd37c5ea93b6cfdd3a49" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="752efe8e661b9bc3b45c4e044e1631a3da54dcd6f22a2b6cc8aab6d2a7580dc0" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="564b69a7d569cf56a88af645a81bc097b50a2fbe61c51f2e79b442d8ee4b2be1" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="54e90b842e775151835d26cb77eb4cfe8bd6aaeb17ba8cd91d854ed298e19fc2" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="0a3d90938291de33f2d8da5d9a0c3871b09fe46e658df42fb16359691993760c" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="858791a9c3570b8ef072be36703b5f359031a0c770f88f7e51a882986023ae58" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="9b78a0144c68c730b96e341b7c57e6397bf905e47050a6b89b67e141173b37a5" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="17465722ec4441d07acf7452dd4269c0e289c0ea7cf53eadb47e52c72c5ea937" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="dadb5adaba228a9fc0e4626715ad48be67937854bc79ae4385e8f806583ac06a" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="c0ae2acd544e2a12171b6bd2885102090c1a93ddfd324c5a21b13ac3492d4a0d" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="d8ccc438c96b633fd5625ce3b0ecdbd9e6e4279161e261adc0b07812a7281443" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="d5a356419e0a54e63be5a52bb6d4f86f3585f01256dc953518586762eac7032a" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="3b904cd3ee6b0ad99fe3325f979216ddd9e4bd97e3cae14d1d777532d5bf4328" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="1a4cc777be34945fabe2f862732443480c6f4fe5890910cc9c09e62bab3c3dcc" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="7dddb1c4bf9b679cd5abc0b83ad99595600a2acc3bbfce414d91afa93ec094f5" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="44f7bd25ac58a7184897c900a8028408332a5b4229645a3744a562364963516a" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="c68d05b75de68ded673a5c95e7d2fa052a7a991a893e672bcf4404cd831da638" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="6a08f8b2ed45aedc4faaeb132a82d96a88d376dc7211b13c2c37c823e7124be7" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="cb84b3ddf411c398be57f21709853d11a260df7f6a68bca48df69b100a5e87c7" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="1338399d5b49f5e0b7097edddee53dc57604bb86826d7db158a5a4957a111d59" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="fbb1781df75583a9ad7587638500cd2088432116c0eddbd309c37a323edb9f48" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="99835d98608c3bae1fd4ce2a3952946f4dad68f2225c028e3caa47b2b049b7d4" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="95d0e0f951328949986e6a530f5bfa76274477e7ef4f38cc5ba3110c2a5a9038" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="b2e6f499611d2d42e627ff8c9a53b8f10e7c6dc7603370f7966108d93335ca93" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="94e46c6250d16336825c8346c587ce8934c9dc00d4fc8222df68c5a7233fa09f" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="e4ed957b73232bb5cda98cf1047fd16de29e9992b49f6cd18c366483895521f0" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="eba6f27842a2e5f2f2b65bb1558333341a58c594a1d2c2cd8f3454c3ab739014" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="c058a53084750cf9a57c76c5f646f5557ead4bd3a4b77b29e1dec0ac3ecea957" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="63e6bc10d422a4d81a02afd1c720ad53db14b0b79f54f2623a0e866d1e9b402b" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="a6cafef3cf388fa63db5033a09a12124f1c04db78d681d34ca724d4820b10fdb" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="4153d84c3f2d83fc0bfa0e1e9b30d2dfa1a7e663a366918e1a4e5be82c952945" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="d57b014312de5d5d4bd754589564f434a38f9178ab0b058a3f1d4efc63ac7edf" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="4464e42cefe4025df82c5facddd100e8661cdc37e31784c105e599758fd6f7db" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="ef8246d40a0d963e3d05248e24050008d83b3c89a9e4ed32e1394027001227ac" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.52.1"/>
  <changelog author="werner@suse.de" date="1536062400">- Add patch git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  Let bash.bashrc work even for (m)ksh (boo#1104531)
- Add patch git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  No error at login if java system directory is empty (bsc#1102310)</changelog>
  <changelog author="ro@suse.de" date="1551960000">- Add patch git-03-00d332a443062395957f422c89eaed9d0979ec00.patch
  * update logic for JRE_HOME env variable (bsc#1128246)</changelog>
  <changelog author="ro@suse.de" date="1552305600">- Add patch git-04-b66cf03e673e84902ce0330f88f84f4fbdc8c9e9.patch
  * Restore old position of ssh/sudo source of profile
    for bug bsc#1118364 but hopefully do not reintroduce
    bug boo#1088524</changelog>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
</package>
<package pkgid="d44dc60330dc2e784989a9aae07adfb2997ed38262fabd67b33fdfa5a3bad97f" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="dcd0959ce154d6900a4357b558bb81c2bb78f83ed6aa0ecbbd84afe549c072b2" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="7902b3e1f0d59eebcdf0fbde63516f55d082853195438c4ea111251c40457058" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="c54a775f3bdd42385386ebfc46f00e26ec93ab8142e93161778fe9c1238d6a09" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="3.57.1"/>
  <changelog author="ro@suse.de" date="1554465600">- Add patch git-05-ae2a49183ba0ad9dff6b8c1efd4de076bd34ab0f.patch
  * /etc/profile does not work in AppArmor-confined containers
    (bsc#1096191)</changelog>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
</package>
<package pkgid="aec47488f547172ed4e975018ba2d56a4afab1a64dd9aca3c1ec48cbe1b5252b" name="abseil-cpp" arch="aarch64">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="73056a9e48647990fc88b5b5a0d11fb609865fe63cc97f0ee8358f593b133e45" name="abseil-cpp" arch="ppc64le">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="b15062db2a05be27e676d0b6d30f96f5fb47ff5e34138cad206789522f1eef8d" name="abseil-cpp" arch="s390x">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="759dd254206b1ae87989050cf6bef57564201e60d968a080d0ee49ac6f157f36" name="abseil-cpp" arch="src">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="d21c8a97178ab61a0b87d84dcaf351b0e4dcc09880586552b3486b94e14b30fb" name="abseil-cpp" arch="x86_64">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="b33b1c9ccbe27dc36a4f668b9d44e764556c2efd4e9d0a2856901721737b32bf" name="abseil-cpp" arch="aarch64">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="50f2473161f125cf053daa6783c9951dfe114133952f7b8681081160d8e5e2e8" name="abseil-cpp" arch="ppc64le">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="599844e6ad658243d57a6d3b157af440e5603dc96965d3e1f06b47c0732ef6d0" name="abseil-cpp" arch="s390x">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="4c13e74e09aab68edf3b15353dc22c1fe755190a27aac62cc2b37c6d57624d44" name="abseil-cpp" arch="src">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="b65bb56f287ebdfbd36ff65d53195cf2b059a6f44d98abc9014f4a76d1a6483b" name="abseil-cpp" arch="x86_64">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="bddb9dbf3fe455d31b30766dabaf2d087bebf6d264ec85b5d4074c0cb881ba5b" name="abseil-cpp-devel" arch="aarch64">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="ea278c289782b3c30f894cc9751fdb7ace893d96a9ec4281b936c7f2ce2b5b51" name="abseil-cpp-devel" arch="ppc64le">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="f6dde428d122b69b48576d81f628b640900c9cb6f70751b22ed7848cc0f51ca5" name="abseil-cpp-devel" arch="s390x">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="72eeb841e7a8306b29f9a6d17c43a8e0c3a49d2d8da11bfd0febf4aafb50d2e3" name="abseil-cpp-devel" arch="x86_64">
  <version epoch="0" ver="20211102.0" rel="150300.7.3.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551355200">- Fix build with Bazel 0.22.0.
- Add optflags.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
</package>
<package pkgid="fb349ecf237abf655d1781165fd59fdd6f775e0b25cd8cfb7f89150839782646" name="abseil-cpp-devel" arch="aarch64">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="5ff7027d237df2366917cba997b456167f592097453bcb02aa3d706fdc2cc830" name="abseil-cpp-devel" arch="ppc64le">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="e3978bc854dce03ebe43830e893ed7a1cb476d87155a2c8e8b45c883d589d9f5" name="abseil-cpp-devel" arch="s390x">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="48723eeefafe3feeae96484106404892d4dda717369d8902bc62f867ac425cda" name="abseil-cpp-devel" arch="x86_64">
  <version epoch="0" ver="20211102.0" rel="150300.7.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1551960000">- Add soname to all *.so* files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1563969600">- Use bazel0.19 as build fails with the latest bazel (0.26)</changelog>
  <changelog author="mrostecki@opensuse.org" date="1568894400">- Add source package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Update to version 20190605:
  * avoid use of undefined ABSL_HAVE_ELF_MEM_IMAGE
  * Avoid undefined behavior when nullptr is passed to memcpy with size 0
  * CMake: Set correct flags for clang-cl
  * Adding linking of CoreFoundation to CMakeLists in absl/time as
    time_zone_lookup.cc includes CoreFoundation
  * Implement Span::first and Span::last from C++20
  * Changed HTTP URLs to HTTPS where possible
  * Fix GCC8 warnings
  * Fix library order for Conan package
  * _umul128 is not available on Windows ARM64
  * Add note at top that this is supported best-effort
  * Update Conan author
  * Add Conan topics
  * Remove cctz as external dependency
  * Add Conan recipe</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="bwiedemann@suse.com" date="1574510400">- Sort find output to make build reproducible (boo#1041090)</changelog>
  <changelog author="svasudevan@suse.com" date="1576670400">- Update to version 20190808</changelog>
  <changelog author="dimstar@opensuse.org" date="1579003200">- Set ExcludeArch: %ix86: bazel is required to build which in turn
  is not supported on ix86.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579176000">- Remove all packages except source.</changelog>
  <changelog author="elimat@opensuse.org" date="1595592000">- Update to version 20200225.2
  * This release fixes the list of dependencies of absl::Cord in the CMake build.
  * bug fix for absl::Status::ErasePayload</changelog>
  <changelog author="jengelh@inai.de" date="1599307200">- Switch the package to noarch.</changelog>
  <changelog author="jengelh@inai.de" date="1603800000">- Build shared libraries of abseil for use by grpc
  (related to https://github.com/grpc/grpc/issues/24476)</changelog>
  <changelog author="fvogt@suse.com" date="1604664000">- Drop source package, was only used by grpc which was switched
  over to use the shared library</changelog>
  <changelog author="elimat@opensuse.org" date="1609243200">- Update to version 20200923.2
  What's New:
  * absl::StatusOr&lt;T&gt; has been released. See our blog
    post for more information.
  * Abseil Flags reflection interfaces have been released.
  * Abseil Flags memory usage has been significantly optimized.
  * Abseil now supports a "hardened" build mode. This build mode enables
    runtime checks that guard against programming errors that may lead
    to security vulnerabilities.
  Notable Fixes:
  * Sanitizer dynamic annotations like AnnotateRWLockCreate that are
    also defined by the compiler sanitizer implementation are no longer
    also defined by Abseil.
  * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions.
  * Sanitizer usage is now automatically detected and no longer requires
    macros like ADDRESS_SANITIZER to be defined on the command line.
  Breaking Changes:
  * Abseil no longer contains a dynamic_annotations library. Users
    using a supported build system (Bazel or CMake) are unaffected by
    this, but users manually specifying link libraries may get an error
    about a missing linker input.</changelog>
  <changelog author="rpm@fthiessen.de" date="1618315200">- Update to LTS version 20210324.0
  * Breaking: The empty absl::container target has been removed from
    the CMake build. This target had no effect and references to
    this target in user code can safely be removed.
  * New: The cleanup library has been released. This library contains
    the control-flow-construct-like type absl::Cleanup which is used
    for executing a callback on scope exit.
  * New: The numeric library now includes bits.h, a polyfill header
    containing implementations of C++20's bitwise math functions.
  * New: Abseil now installs pkg-config files to make it easier to
    use Abseil with some other build systems.
  * New: Abseil now respects the default CMake installation paths.
    Standard CMake variables like CMAKE_INSTALL_PREFIX can be used
    to change the installation path.
- Added Correctly-install-pkgconfig.patch from upstream to fix
  installation of pkgconfig files
- Call ldconfig on post and postun</changelog>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663070400">- Add options-old.patch
  * Make the headers always tell the truth about the ABI to fix
    linker error when using new compilers (boo#1203378)
- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
</package>
<package pkgid="389f927e48e1c2355117da646dd9bb90ddae6bd06f9e7f141319793417ff11a1" name="acct" arch="aarch64">
  <version epoch="0" ver="6.6.4" rel="4.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 6.6.2
  + Link with -lm.
  + Fix texi.
  + The rest of fixes from 6.5.5 to 6.6.1.
- Update Url to new project home
- Use download Url
- Remove dependency on gpg-offline and keyring files; let OBS handle
  source verification
- Adapt acct-hz.patch to upstream changes
  &gt; acct-6.6.2-hz.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1418990400">- Add back .keyring and .sig files; OBS verify them too</changelog>
  <changelog author="p.drouand@gmail.com" date="1425211200">- Fixthe log path in service and logrotate files; fix bnc#915654</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- install deinstall needs to be in preun</changelog>
  <changelog author="tchvatal@suse.com" date="1434974400">- Use try-restart not restart on logrotate update, otherwise we could
  suprisingly start the service for user, which is not desired
- Cleanup with spec-cleaner
- Use tmpfiles creation instead of hand-written shell script</changelog>
  <changelog author="tchvatal@suse.com" date="1434974401">- Use just /var/log/account/pacct file and remove the tmpfiles creation
  completely</changelog>
  <changelog author="tchvatal@suse.com" date="1435838400">- The previous commit ghosted the log file, but we need it empty
  and present to start with, so unghost it</changelog>
  <changelog author="olaf@aepfle.de" date="1457092800">- Remove timestamp from info file
  acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1468411200">- remove syslog.target from acct.service file [bsc#983938]</changelog>
  <changelog author="kstreitova@suse.com" date="1490788800">- cleanup with spec-cleaner
- get rid of %{name} and %{version} macros from the patch names</changelog>
  <changelog author="mpluskal@suse.com" date="1491480000">- Update to version 6.6.3:
  * Fixed manuals.
- Refresh patches:
  * acct-6.6.2-hz.patch
  * acct-info.patch
- Drop no longer needed:
  * acct-ac.patch
  * acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1492084800">- remove acct-info.patch that is no longer needed (fixed upstream
  in version 6.6.3)
- note: acct-6.6.2-hz.patch was not accepted upstream as it might
  break support for the HP alpha platform</changelog>
  <changelog author="astieger@suse.com" date="1499688000">- update to 6.6.4:
  * Added --pid to 'lastcomm'.</changelog>
  <changelog author="kstreitova@suse.com" date="1505822400">- acct.service: fix chmod command call to use an absolute path
  [bsc#1053528]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Migrate pacct log file to new location when upgrading from SLE12,
  fixes bsc#1188159</changelog>
</package>
<package pkgid="82f969b95a6604e36cd50ca51082d24667cfca6aa750c41b76ad412f0809db7e" name="acct" arch="ppc64le">
  <version epoch="0" ver="6.6.4" rel="4.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 6.6.2
  + Link with -lm.
  + Fix texi.
  + The rest of fixes from 6.5.5 to 6.6.1.
- Update Url to new project home
- Use download Url
- Remove dependency on gpg-offline and keyring files; let OBS handle
  source verification
- Adapt acct-hz.patch to upstream changes
  &gt; acct-6.6.2-hz.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1418990400">- Add back .keyring and .sig files; OBS verify them too</changelog>
  <changelog author="p.drouand@gmail.com" date="1425211200">- Fixthe log path in service and logrotate files; fix bnc#915654</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- install deinstall needs to be in preun</changelog>
  <changelog author="tchvatal@suse.com" date="1434974400">- Use try-restart not restart on logrotate update, otherwise we could
  suprisingly start the service for user, which is not desired
- Cleanup with spec-cleaner
- Use tmpfiles creation instead of hand-written shell script</changelog>
  <changelog author="tchvatal@suse.com" date="1434974401">- Use just /var/log/account/pacct file and remove the tmpfiles creation
  completely</changelog>
  <changelog author="tchvatal@suse.com" date="1435838400">- The previous commit ghosted the log file, but we need it empty
  and present to start with, so unghost it</changelog>
  <changelog author="olaf@aepfle.de" date="1457092800">- Remove timestamp from info file
  acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1468411200">- remove syslog.target from acct.service file [bsc#983938]</changelog>
  <changelog author="kstreitova@suse.com" date="1490788800">- cleanup with spec-cleaner
- get rid of %{name} and %{version} macros from the patch names</changelog>
  <changelog author="mpluskal@suse.com" date="1491480000">- Update to version 6.6.3:
  * Fixed manuals.
- Refresh patches:
  * acct-6.6.2-hz.patch
  * acct-info.patch
- Drop no longer needed:
  * acct-ac.patch
  * acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1492084800">- remove acct-info.patch that is no longer needed (fixed upstream
  in version 6.6.3)
- note: acct-6.6.2-hz.patch was not accepted upstream as it might
  break support for the HP alpha platform</changelog>
  <changelog author="astieger@suse.com" date="1499688000">- update to 6.6.4:
  * Added --pid to 'lastcomm'.</changelog>
  <changelog author="kstreitova@suse.com" date="1505822400">- acct.service: fix chmod command call to use an absolute path
  [bsc#1053528]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Migrate pacct log file to new location when upgrading from SLE12,
  fixes bsc#1188159</changelog>
</package>
<package pkgid="160277b79e0cba72e13d4227b363f323b95f966539862cf1d4b2afaa584fc323" name="acct" arch="s390x">
  <version epoch="0" ver="6.6.4" rel="4.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 6.6.2
  + Link with -lm.
  + Fix texi.
  + The rest of fixes from 6.5.5 to 6.6.1.
- Update Url to new project home
- Use download Url
- Remove dependency on gpg-offline and keyring files; let OBS handle
  source verification
- Adapt acct-hz.patch to upstream changes
  &gt; acct-6.6.2-hz.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1418990400">- Add back .keyring and .sig files; OBS verify them too</changelog>
  <changelog author="p.drouand@gmail.com" date="1425211200">- Fixthe log path in service and logrotate files; fix bnc#915654</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- install deinstall needs to be in preun</changelog>
  <changelog author="tchvatal@suse.com" date="1434974400">- Use try-restart not restart on logrotate update, otherwise we could
  suprisingly start the service for user, which is not desired
- Cleanup with spec-cleaner
- Use tmpfiles creation instead of hand-written shell script</changelog>
  <changelog author="tchvatal@suse.com" date="1434974401">- Use just /var/log/account/pacct file and remove the tmpfiles creation
  completely</changelog>
  <changelog author="tchvatal@suse.com" date="1435838400">- The previous commit ghosted the log file, but we need it empty
  and present to start with, so unghost it</changelog>
  <changelog author="olaf@aepfle.de" date="1457092800">- Remove timestamp from info file
  acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1468411200">- remove syslog.target from acct.service file [bsc#983938]</changelog>
  <changelog author="kstreitova@suse.com" date="1490788800">- cleanup with spec-cleaner
- get rid of %{name} and %{version} macros from the patch names</changelog>
  <changelog author="mpluskal@suse.com" date="1491480000">- Update to version 6.6.3:
  * Fixed manuals.
- Refresh patches:
  * acct-6.6.2-hz.patch
  * acct-info.patch
- Drop no longer needed:
  * acct-ac.patch
  * acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1492084800">- remove acct-info.patch that is no longer needed (fixed upstream
  in version 6.6.3)
- note: acct-6.6.2-hz.patch was not accepted upstream as it might
  break support for the HP alpha platform</changelog>
  <changelog author="astieger@suse.com" date="1499688000">- update to 6.6.4:
  * Added --pid to 'lastcomm'.</changelog>
  <changelog author="kstreitova@suse.com" date="1505822400">- acct.service: fix chmod command call to use an absolute path
  [bsc#1053528]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Migrate pacct log file to new location when upgrading from SLE12,
  fixes bsc#1188159</changelog>
</package>
<package pkgid="4122636d9ec34778efe41794e4b4c107b2049b2475c14fade98851c99987d833" name="acct" arch="src">
  <version epoch="0" ver="6.6.4" rel="4.3.1"/>
  <changelog author="schuetzm@gmx.net" date="1370520000">- Converted rc file to systemd unit file.
- Fixed a bug where the accounting file wasn't reopened after
  logrotate, because force-reload isn't implemented.</changelog>
  <changelog author="p.drouand@gmail.com" date="1382184000">- Remove useless %inserv_prereq and fillup_prereq macro; acct package
  doesn't contain neither sysvinit script and sysconfig file</changelog>
  <changelog author="vcizek@suse.com" date="1387627200">- update to 6.6.1
  * Fixed vulnabilities, due to autmake. Thanks to Karl Berry
    for pointing this out.
  * Update gnulib to latest git.
- dropped acct-stdio.h.patch (upstream)
- add gpg verification</changelog>
  <changelog author="werner@suse.de" date="1395057600">- cleanup of acct
  * Add install section in service unit (bnc#867138)
  * Add a simple script to create pacct file</changelog>
  <changelog author="vcizek@suse.com" date="1409227200">- fixed libexec path in acct.service (bnc#893980)</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 6.6.2
  + Link with -lm.
  + Fix texi.
  + The rest of fixes from 6.5.5 to 6.6.1.
- Update Url to new project home
- Use download Url
- Remove dependency on gpg-offline and keyring files; let OBS handle
  source verification
- Adapt acct-hz.patch to upstream changes
  &gt; acct-6.6.2-hz.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1418990400">- Add back .keyring and .sig files; OBS verify them too</changelog>
  <changelog author="p.drouand@gmail.com" date="1425211200">- Fixthe log path in service and logrotate files; fix bnc#915654</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- install deinstall needs to be in preun</changelog>
  <changelog author="tchvatal@suse.com" date="1434974400">- Use try-restart not restart on logrotate update, otherwise we could
  suprisingly start the service for user, which is not desired
- Cleanup with spec-cleaner
- Use tmpfiles creation instead of hand-written shell script</changelog>
  <changelog author="tchvatal@suse.com" date="1434974401">- Use just /var/log/account/pacct file and remove the tmpfiles creation
  completely</changelog>
  <changelog author="tchvatal@suse.com" date="1435838400">- The previous commit ghosted the log file, but we need it empty
  and present to start with, so unghost it</changelog>
  <changelog author="olaf@aepfle.de" date="1457092800">- Remove timestamp from info file
  acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1468411200">- remove syslog.target from acct.service file [bsc#983938]</changelog>
  <changelog author="kstreitova@suse.com" date="1490788800">- cleanup with spec-cleaner
- get rid of %{name} and %{version} macros from the patch names</changelog>
  <changelog author="mpluskal@suse.com" date="1491480000">- Update to version 6.6.3:
  * Fixed manuals.
- Refresh patches:
  * acct-6.6.2-hz.patch
  * acct-info.patch
- Drop no longer needed:
  * acct-ac.patch
  * acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1492084800">- remove acct-info.patch that is no longer needed (fixed upstream
  in version 6.6.3)
- note: acct-6.6.2-hz.patch was not accepted upstream as it might
  break support for the HP alpha platform</changelog>
  <changelog author="astieger@suse.com" date="1499688000">- update to 6.6.4:
  * Added --pid to 'lastcomm'.</changelog>
  <changelog author="kstreitova@suse.com" date="1505822400">- acct.service: fix chmod command call to use an absolute path
  [bsc#1053528]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Migrate pacct log file to new location when upgrading from SLE12,
  fixes bsc#1188159</changelog>
</package>
<package pkgid="936d80b3f678088567393f8d16872f8f9246e968957c8505db1c5276d3fe79c8" name="acct" arch="x86_64">
  <version epoch="0" ver="6.6.4" rel="4.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Update to version 6.6.2
  + Link with -lm.
  + Fix texi.
  + The rest of fixes from 6.5.5 to 6.6.1.
- Update Url to new project home
- Use download Url
- Remove dependency on gpg-offline and keyring files; let OBS handle
  source verification
- Adapt acct-hz.patch to upstream changes
  &gt; acct-6.6.2-hz.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1418990400">- Add back .keyring and .sig files; OBS verify them too</changelog>
  <changelog author="p.drouand@gmail.com" date="1425211200">- Fixthe log path in service and logrotate files; fix bnc#915654</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- install deinstall needs to be in preun</changelog>
  <changelog author="tchvatal@suse.com" date="1434974400">- Use try-restart not restart on logrotate update, otherwise we could
  suprisingly start the service for user, which is not desired
- Cleanup with spec-cleaner
- Use tmpfiles creation instead of hand-written shell script</changelog>
  <changelog author="tchvatal@suse.com" date="1434974401">- Use just /var/log/account/pacct file and remove the tmpfiles creation
  completely</changelog>
  <changelog author="tchvatal@suse.com" date="1435838400">- The previous commit ghosted the log file, but we need it empty
  and present to start with, so unghost it</changelog>
  <changelog author="olaf@aepfle.de" date="1457092800">- Remove timestamp from info file
  acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1468411200">- remove syslog.target from acct.service file [bsc#983938]</changelog>
  <changelog author="kstreitova@suse.com" date="1490788800">- cleanup with spec-cleaner
- get rid of %{name} and %{version} macros from the patch names</changelog>
  <changelog author="mpluskal@suse.com" date="1491480000">- Update to version 6.6.3:
  * Fixed manuals.
- Refresh patches:
  * acct-6.6.2-hz.patch
  * acct-info.patch
- Drop no longer needed:
  * acct-ac.patch
  * acct-timestamp.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1492084800">- remove acct-info.patch that is no longer needed (fixed upstream
  in version 6.6.3)
- note: acct-6.6.2-hz.patch was not accepted upstream as it might
  break support for the HP alpha platform</changelog>
  <changelog author="astieger@suse.com" date="1499688000">- update to 6.6.4:
  * Added --pid to 'lastcomm'.</changelog>
  <changelog author="kstreitova@suse.com" date="1505822400">- acct.service: fix chmod command call to use an absolute path
  [bsc#1053528]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Migrate pacct log file to new location when upgrading from SLE12,
  fixes bsc#1188159</changelog>
</package>
<package pkgid="7526a6809237f850ceaf054d689b2a48f79669bff4d11fca7eea6edb0014fc78" name="adcli" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="237e3b9c96ff1348cb3d2cd97f1e0abfd36cbd2bbc0f113faafe386c8fae59e3" name="adcli" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="f13512bcd0614bd2c38879499a3c695ede4091bf190d40bf6f11355b873ebf85" name="adcli" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="ab7395b6ab967beafad76686bfe77e22fbd916ca914ba5ab514daa00ad210b09" name="adcli" arch="src">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="f59cd974aad92560a1a388e88a8fda4fd387af4cac531fa1c8fbf3c01835bdae" name="adcli" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="7688a01e1f73a7ae140785a75182304bc1e41e6a095bc0d91caac176ca6ea7e8" name="adcli" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="f9ee6838bf3da37305a545766c7245d3e623d108600062b86b06577d682d8ea8" name="adcli" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="4a5c5a26cc035e2fa0092aa0dcf1731cb176cfe9608ca5b8f20bdb1eca5dfe6e" name="adcli" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="557fce228fbe4f4c20a5807c2841c4fdc2c847be10d9d29e20d75c00bb896b00" name="adcli" arch="src">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="211ca0ccc22e012a605a88c7df1090a06132aa6137428fdf2f3d3769f46d8abe" name="adcli" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="ebac07fa0c75382c69c046892d60eff95cf3d55b11d3f89839a108e484323169" name="adcli-doc" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="e59b5f0bbea207382cd9caedba093668001eecc5211fdb12654131191ad5df3f" name="adcli-doc" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="56a5b13e87dd9da573716aa17d545bc0d46b178cd61e5097a1aee84b28a63cfd" name="adcli-doc" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="c9204bb3989d3ea82a4e6146b8d3cdf4aab209fb152c42b80473ca031697a6e2" name="adcli-doc" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150200.9.9.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
</package>
<package pkgid="11c0c24e0c4fdfdf844328542db3baba364016ae47a22da84239e66972fef850" name="adcli-doc" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="753547155ba9c2871044695245863623b52c323519cae2a7005d057c861b4b4d" name="adcli-doc" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="7088edc505b3ba00d0fbcd170d60a751d17a7fb372f7407334ec393605c48a1f" name="adcli-doc" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="1b3292f7606262a09a2062fcae7fc9a77c9c3a7b8918b9638362d6b9364342ef" name="adcli-doc" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="9.6.1"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1632398400">- Add dont-expire-password option; (jsc#SLE-21224);
  * Add 0036-Add-dont-expire-password-option.patch
  * Add 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
</package>
<package pkgid="b936728c748d4c05ac4a89054b418e5ac26775925401e097631f87c66650483d" name="adios-gnu-mpich-hpc" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="21f3e5fb658656cbae2fbaad9e0ae72762e64270620e4d5b1e016d3100feb703" name="adios-gnu-mpich-hpc-devel" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="29c3f3587aac1caa8c8382eca82adc270ccb3aa2bedb5ce04c1c5164394b093c" name="adios-gnu-mpich-hpc-devel-static" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="2512cf1d107fcc894f3d22151286b72205db29c921bb8267debd6e03c6afd897" name="adios-gnu-mvapich2-hpc" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="4f8241869515a01335b5d4217009753ee91c46fa24e305725f8b0d7038360050" name="adios-gnu-mvapich2-hpc-devel" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="3698e4eccdd0928a71cc81be6002b0d8c05d4e10d22ab8149006c77dcfb69fcd" name="adios-gnu-mvapich2-hpc-devel-static" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="d8aeebd644fddc179345df6d162197c1080899c4ae9bf1c857b264f7f66cf68c" name="adios-gnu-openmpi2-hpc" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="eb427282166aedecb69df8f0773aa57e08247762263a043ae2877cafaafa5afc" name="adios-gnu-openmpi2-hpc-devel" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="d698f2740176cf9b2de127d160b973a16a7049c986d96d3c857954a68cb87f82" name="adios-gnu-openmpi2-hpc-devel-static" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="7755407dd5ead6aff83f4d87a43b0820d948fe5ec82bc99a52361ca59144b533" name="adios-gnu-openmpi3-hpc" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="5ec0fee4ecfba23269c52b3d5c1942cd5f14ce7909de2da3f6cf73b577ecb878" name="adios-gnu-openmpi3-hpc-devel" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="c74d064a199ca6151707cf7ce34e41a91949b25e2b3a4ac39b93d90c23a9e498" name="adios-gnu-openmpi3-hpc-devel-static" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="46df3ae2fe9ae3b40711518de967d259ea6b1fc4707e124dd8e5cc12d52503b6" name="adios-gnu-openmpi4-hpc" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="14c9cd209fd2e753199b530422b8122bc90e3232975ee3a96943da5abf8a7386" name="adios-gnu-openmpi4-hpc-devel" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="bd68f15629b03ec9ab589ec45a435f7ca73761a28ad210164313b122e372e475" name="adios-gnu-openmpi4-hpc-devel-static" arch="noarch">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="6edbbdba15543c59aaf3c2212e7a989763bac0a462ae8642a31ca446507a35c2" name="adios_1_13_1-gnu-mpich-hpc" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="6fcbd01d5233819b4cfe178fd96142db087ed529f8c19a471d94db3b1d36eee6" name="adios_1_13_1-gnu-mpich-hpc" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="44863a68681f515a7895f0e017b254c5e985ddae38197b3fa904358a98ccbbc4" name="adios_1_13_1-gnu-mpich-hpc" arch="src">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="03631f799997b18a7036ff02857ea5ca5fa4dcd547979f861e7894256f3e338d" name="adios_1_13_1-gnu-mpich-hpc" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="ede31ca73a7131cef417a21de5fdf9ee6242bab9a387a53f2dab8e8b844267b4" name="adios_1_13_1-gnu-mpich-hpc-devel" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="f11d10b3d09ba38ce26246d10a327848a4e55522f51043e5bfa8254366efa25b" name="adios_1_13_1-gnu-mpich-hpc-devel" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="0332ed46dd6e42b3d86edd91c6cc63e2f175a98570febbc47cebbcc40ef87bcb" name="adios_1_13_1-gnu-mpich-hpc-devel" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="4393066728e3c26bc4eab22a2c91d1e647be09f9109111bad2f4c769c48708cb" name="adios_1_13_1-gnu-mpich-hpc-devel-static" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="2c111937e5647854659e69667e74c818b73299ba6251ae20670b40cd338b0f54" name="adios_1_13_1-gnu-mpich-hpc-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="29a27395723d23856ba603a25321534711fea70481c72c25549d45041a2c6555" name="adios_1_13_1-gnu-mpich-hpc-devel-static" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="2f0c6155e72fa1f2739356b98a46da9da2018aaf054870d88761fb44e961f714" name="adios_1_13_1-gnu-mvapich2-hpc" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="15e4c09bc679ef66f291d8fe38cdb58d381b4fd1a20d447e1e31c026678a8e9a" name="adios_1_13_1-gnu-mvapich2-hpc" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="61b2eb29e076b26f5aa760d957f3cb1635d7a41ed91fdaad7350809b99265877" name="adios_1_13_1-gnu-mvapich2-hpc" arch="src">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="2b0bf3a601a735f9f7bd709053f45d84263273429bb73909e50f52c98655f512" name="adios_1_13_1-gnu-mvapich2-hpc" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="8d5c8013270ffbf839bfbc59b43639b3669cbd0e99d6e791190e75063bb83375" name="adios_1_13_1-gnu-mvapich2-hpc-devel" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="3d3ec994e7bb81b5b7f7649d84070e74e2669190ed1474be902b2319d392be08" name="adios_1_13_1-gnu-mvapich2-hpc-devel" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="4dcee28aa44b4765609a76f994e0aa5ca142d0e6eee47138ead0183a5a9bd5bc" name="adios_1_13_1-gnu-mvapich2-hpc-devel" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="547f0f72fa894a2a31ba454b8ee5139223b0118314fd6ea3c7f20756cd2fd22e" name="adios_1_13_1-gnu-mvapich2-hpc-devel-static" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="7b9213087bb094680be5867936467a9f75b841464bc0416e78918e8cad989d93" name="adios_1_13_1-gnu-mvapich2-hpc-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="613a10b2ed7bebac261e50bed12d5ff135774285e36a030d2089ab9268c3d9ab" name="adios_1_13_1-gnu-mvapich2-hpc-devel-static" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="b657eeade2659490895b05eaa4cf23eb950f35540c22ac368dac3bfe0f823aca" name="adios_1_13_1-gnu-openmpi2-hpc" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="4d53385a135326abeb85eb2b52a627bf7252f91443782f693a12f37a9dd96d82" name="adios_1_13_1-gnu-openmpi2-hpc" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="b9371955a115a5f126136c958a8ed5421b493d0622f6b709dc599ee7f33c9ca9" name="adios_1_13_1-gnu-openmpi2-hpc" arch="src">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="b5f46626a6114fefc45c4349dbe815e0283256157ede600158d47e0cd3648675" name="adios_1_13_1-gnu-openmpi2-hpc" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="38a4a6d90dae97a7f4de3f3e22405d81caa71f92e531aacfb20a69c0caeecf72" name="adios_1_13_1-gnu-openmpi2-hpc-devel" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="926c2e082bbb9f703cf7a7e7851e2790a380bf1527ae56defa42935142eb4625" name="adios_1_13_1-gnu-openmpi2-hpc-devel" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="faa13dd6cf04d0ed0cac94d48a544f05d799188d587a10a18248c9117a0aacba" name="adios_1_13_1-gnu-openmpi2-hpc-devel" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="c686c21bd4d76d57459817e30d4c3df9c62adf5e828bd8d4989343e1d98e66f3" name="adios_1_13_1-gnu-openmpi2-hpc-devel-static" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="35c6c2e36c3bad7d93adeb895c5e27d49db8858b0bdb407db51b3138e8590cc7" name="adios_1_13_1-gnu-openmpi2-hpc-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="7f4f7ccb6c2870525a7beda32faa42c989a41c208046a0883c38f53c9b73a4b1" name="adios_1_13_1-gnu-openmpi2-hpc-devel-static" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="bc097564e53bcb80934b34a2531fdb5785914a24609e716c0528c7fd1bbf9c73" name="adios_1_13_1-gnu-openmpi3-hpc" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="d9cfb8a9a645879fb0e906c8c0913ee9e8e57ba62560099ce312ba77d9b4c0c6" name="adios_1_13_1-gnu-openmpi3-hpc" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="9095286e84e2764c7544660a80faa31255f93918dd4009e66a6322a91298e813" name="adios_1_13_1-gnu-openmpi3-hpc" arch="src">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="bdcad76556702c6e8a2bf9fc8bd5575c2d1411a97f722b70b1d7757be0509464" name="adios_1_13_1-gnu-openmpi3-hpc" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="276a19936dd28b99c3c290c63a437a97136c1f3ea1ba16a1dfda135126008746" name="adios_1_13_1-gnu-openmpi3-hpc-devel" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="f55d8e3e2d505cb1e7513ae173991434869047a1257529b3507a2aca2a3d5682" name="adios_1_13_1-gnu-openmpi3-hpc-devel" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="b5f3f3fcb3a630637722805a0cf9cf19b419f2a298b01fef27ab8725cbb020ab" name="adios_1_13_1-gnu-openmpi3-hpc-devel" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="f98a84be748ff04127cca79eb6cec664d7ed156a1fe6040412ff8b29da758849" name="adios_1_13_1-gnu-openmpi3-hpc-devel-static" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="ab7fa908bce4bece928373d83046457fc167df0c9eebadb9af9b45e4d360f35f" name="adios_1_13_1-gnu-openmpi3-hpc-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="c0040e3a77981928f8e65e48328d5095a4c60187e93067a3ff578c90b64bc0b1" name="adios_1_13_1-gnu-openmpi3-hpc-devel-static" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="1bde2d8975ea658c99acc9394b08cd8cdc4baebeebde6ea60b1696da6f69a7a7" name="adios_1_13_1-gnu-openmpi4-hpc" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="00b1a1bd673db3bfae317d9b5368c3f4aace46ffd11cb51a89544aaee333d8ce" name="adios_1_13_1-gnu-openmpi4-hpc" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="5c1e4eeb9fb452ed79ec5f6f63d6f46e5ba6749bc65551e911fbe9f32d92b76f" name="adios_1_13_1-gnu-openmpi4-hpc" arch="src">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="81d19c9c74e195d20e9b20dc738d009e8860263857c850766d4ad5e04e090664" name="adios_1_13_1-gnu-openmpi4-hpc" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="c5e2666901ebd8056758ecb2ea9f822796eba031f2bc647ba7d01e7a2798e8e2" name="adios_1_13_1-gnu-openmpi4-hpc-devel" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="8657a4a62449ac650522ce1d6ee44caa77115cd915be211af651b7470420017a" name="adios_1_13_1-gnu-openmpi4-hpc-devel" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="56630b4985e5df4e815356a671bb8b62b90e8bb5530ddfccab20b4dfbf1be87c" name="adios_1_13_1-gnu-openmpi4-hpc-devel" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="f503360f1860c6e663e2ab0a26bae650c6fcbeae812b799a82765a62054601b9" name="adios_1_13_1-gnu-openmpi4-hpc-devel-static" arch="aarch64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="cba9f9829a4762cd39fa5d5ff86dded6656c73fff059c80555d663bf8382a1ac" name="adios_1_13_1-gnu-openmpi4-hpc-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="4a2ffcc653360d00c3da58e9dcd197054837cb5f5eda7a38c522892ccd647873" name="adios_1_13_1-gnu-openmpi4-hpc-devel-static" arch="x86_64">
  <version epoch="0" ver="1.13.1" rel="150300.12.2.1"/>
  <changelog author="jjolly@suse.com" date="1515153600">- First pass on adios specfile</changelog>
  <changelog author="jjolly@suse.com" date="1515499200">- Added hpc macros support
  * Added _multibuild with serial, openmpi, and gnu-openmpi-hpc
  * Created devel package and module package
  * Created lua lmod module file for adios
- Added adios-correct-func-ret.patch</changelog>
  <changelog author="aguerrero@suse.com" date="1550664000">- Update to version 1.31.1 (jsc#SLE-6004)
- Add python support:
  * This is only for Python2
  * Update in the module file
  * Add needed Requires on python2-xml and python2-PyYAML
- Fix a few python shebangs with patch fix_python_shebang.patch
- Add a Requires on hdf5 for every mpi flavor and update the module
  file with 'depends-on phdf5'.
- Add examples packages. It's only created for the openmpi flavor
  to avoid having several packages with the same content.
- Spec file polishing: spec-cleaner and update to the lastest
  packaging convention for HPC packages.</changelog>
  <changelog author="aguerrero@suse.com" date="1553515200">- Re-add CPATH, C_INCLUDE_PATH and CPLUS_INCLUDE_PATH to the module
  file.
- Add a separate package with the examples in two flavors one for
  non-HPC and another one for HPC: examples and examples-hpc.
- Update Requires for the devel package.</changelog>
  <changelog author="aguerrero@suse.com" date="1553774400">- Drop the packages and flavors for examples/examples-hpc. It's easier
  for an interested user to download directly the source package and build
  them directly.
- Update the URLs to use https
- Add -L option to the standard master package
- Delete the module .version file in the %postun if it's the default one
- Use the macro %hpc_modules_init to load the module files</changelog>
  <changelog author="jengelh@inai.de" date="1553860800">- Generalize and trim bias from description.</changelog>
  <changelog author="aguerrero@suse.com" date="1554724800">- Update Licensing.</changelog>
  <changelog author="aguerrero@suse.com" date="1554897600">- Fix path for the files that were installed directly at /etc.</changelog>
  <changelog author="aguerrero@suse.com" date="1556539200">- Move the static libraries to a -devel-static packages. Adios doesn't
  provides shared libraries and the static libraries are required for
  the bindings to work.</changelog>
  <changelog author="aguerrero@suse.com" date="1570449600">- Remake patch adios-correct-func-ret.patch to make sure the functions
  return something instead of changing the return type from int to void.</changelog>
  <changelog author="aguerrero@suse.com" date="1571400000">- Disable openmpi3 and the openmpi flavor in SLE.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1574942400">- Fix aarch64 LTO build with -ffat-lto-objects flag</changelog>
  <changelog author="aguerrero@suse.com" date="1575028800">- Add missing FCFLAGS export</changelog>
  <changelog author="eich@suse.com" date="1575028801">- Disable openmpi1 builds for SLE/Leap &gt; 15.1.
- Enable openmpi3 builds for Leap and SLE &gt; 15.1 (jsc#SLE-7773).
- Disable build on s390/s390x as netcdf is not available (bsc#1157965).
- Fix openmpi1 names for non-HPC builds on Factory.</changelog>
  <changelog author="eich@suse.com" date="1575028802">- Add support for gcc7.
- Add support for gcc8 and gcc9 (jsc#SLE-7766 &amp; jsc#SLE-8604).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1575115200">- Correct naming of openmpi1 packages in Leap 15.0/15.1 (still
  called openmpi), fixes unresolvable packages.
- Add non-HPC openmpi2 and openmpi3 flavors.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595073600">- Drop numpy build dependency. The numpy wrapper is currently not
  built, and can be built separately.
- Add -fallow-argument-mismatch Fortran flag to workaround
  GFortran10 being more strict by default.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1595246400">- Adapt to HPC module netcdf naming change (boo#1174291).</changelog>
  <changelog author="eich@suse.com" date="1612353600">- Change 'Requires:' to other HPC packages to %requires_eq to depend
  on the exact version. This should take care of HPC packages ignoring
  proper ABI versioning.</changelog>
  <changelog author="eich@suse.com" date="1612526400">- Add build support for gcc10 to HPC build (bsc#1174439).
- Add openmpi4 flavors.
- Add Fix-code-to-be-python3-compliant.patch:
  Remove python2 code and dependencies.</changelog>
</package>
<package pkgid="961f20c450986a6cda97bdb7ab6b57770f261d78451a25a0f675038ada4b758d" name="aide" arch="aarch64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="61b1c5691ffc4c5d0fb6dc6bf942a1904c72d3115e0fe7b40e2ec53654cedb26" name="aide" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="b1eb01ee10b354ac9e6445f42d6e9681bcc1d7fe8359e7d565cdd860071bd958" name="aide" arch="s390x">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="62aa71df532443dd2218bc7ca10762d48e1f9cff5d46a9bea34cd339cdcb1066" name="aide" arch="src">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="meissner@suse.de" date="1219406400">- enabled SELinux support [Fate#303662]
- enabled curl
- disable static (does not make much sense)</changelog>
  <changelog author="meissner@suse.de" date="1231156800">- fixed abort on check/update by removing the hash requirement bnc#406597
- fixed version output bnc#463511
- enhanced testcase to also run one aide --check</changelog>
  <changelog author="crrodriguez@suse.de" date="1245240000">- fix build when as-needed is a default liker option</changelog>
  <changelog author="mls@suse.de" date="1251288000">- make patch0 usage consistent</changelog>
  <changelog author="ro@suse.de" date="1272542400">- make aide check verbose to get started
- add sleep and sync to fix build</changelog>
  <changelog author="meissner@suse.de" date="1281441600">- updated to 0.15
  - lots of fixes and some new stuff</changelog>
  <changelog author="freespacer@gmx.de" date="1285934400">- updated to version 0.15.1
  - Ignore changed file name if attributes does not match
  - Allow absence of DB_CHECKINODE if file name has changed
- renew patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Add missing call to make
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="e11925980d88b782d432a4fbf67f6aeb2d9abe580970b1da31f056c1a3e78252" name="aide" arch="x86_64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="1144042f23f888592d7f98abe1bb1ec2f909a6f54dcb5fcf501768f76b93cf1c" name="aide" arch="aarch64">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="ab0ca6b62b0b9b593f2aa572eee36b7416e67147892ffa2af678a1c3188e04b3" name="aide" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="20c750168b7190ca002f57865f8448db27b0610325a671c272a8cb392dac331b" name="aide" arch="s390x">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="0510df00d4a49b29d8245e817e2763a8510630c6f5204dc62d3721e5efa3e624" name="aide" arch="src">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="meissner@suse.de" date="1202817600">- Version 0.13.1
  * Fixed bug with reading gzipped aide.db files
  * Removed dead ustat code
- Version 0.13
  * Added support for selinux and xattr attributes
    (kindly contributed by Red Hat)
  * Added support for the Linux Audit System
    (kindly contributed by Red Hat)
  * Fixed usage of libgcrypt instead of libmhash
  * Added file locking for output files
  * Fixed bugs
- Version 0.12
  * Fixed bugs
  * Allow http/https/ftp URLs through libcurl
  * Support posix_fadvice() to avoid caching files
- enabled ACL and XATTR support</changelog>
  <changelog author="meissner@suse.de" date="1219406400">- enabled SELinux support [Fate#303662]
- enabled curl
- disable static (does not make much sense)</changelog>
  <changelog author="meissner@suse.de" date="1231156800">- fixed abort on check/update by removing the hash requirement bnc#406597
- fixed version output bnc#463511
- enhanced testcase to also run one aide --check</changelog>
  <changelog author="crrodriguez@suse.de" date="1245240000">- fix build when as-needed is a default liker option</changelog>
  <changelog author="mls@suse.de" date="1251288000">- make patch0 usage consistent</changelog>
  <changelog author="ro@suse.de" date="1272542400">- make aide check verbose to get started
- add sleep and sync to fix build</changelog>
  <changelog author="meissner@suse.de" date="1281441600">- updated to 0.15
  - lots of fixes and some new stuff</changelog>
  <changelog author="freespacer@gmx.de" date="1285934400">- updated to version 0.15.1
  - Ignore changed file name if attributes does not match
  - Allow absence of DB_CHECKINODE if file name has changed
- renew patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Add missing call to make
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="022b34a3a4a0a8a389011a0e1f433f4a5ad5a5457ffcec51c58b9f045ad1f4b4" name="aide" arch="x86_64">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="d8a35c5736ab73c20045dd1810bdbe0b3d6ce070233008bc0c14c78ff55df1dd" name="aide-test" arch="aarch64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="a6d3535ed0c5a7d2b5a367895a20211aa351a3ce99d0c6dd56f9d232c7301d5f" name="aide-test" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="31831b38570ca25f865e519e453967aff4a9d3ed03cbda93f68396002c92efaf" name="aide-test" arch="s390x">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="3b32f90d38dc481fcc1d355c76d4ce6da1a4788219b4f2dde2dd7cb943e8525b" name="aide-test" arch="x86_64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="628e755c1bed3252d456ce836d3f97508c360d1c09d97462235501662d0e8076" name="aide-test" arch="aarch64">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="cd88c8388a798f7865a45c2343c29ca935f25ccf5cd36c1b870192861e2dfdb3" name="aide-test" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="3dfd3acd0ff4caea9e6ad3cde88fa94f77d7a19aba57b6765f950763a576692a" name="aide-test" arch="s390x">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="9de2bdca255e2cf22d58cec2c0e76a6aad33f850a12d1966d3b43fa4b0eabeba" name="aide-test" arch="x86_64">
  <version epoch="0" ver="0.16" rel="3.9.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
</package>
<package pkgid="03fdb4da64c9d04ddbedf42c1b090f76b8ddeb977e158c7e299b9fbb31807de7" name="alsa-oss" arch="aarch64">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="tiwai@suse.de" date="1398686400">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="660a12d54e71f7d15a7e35c20ef836a3803a48268d8f0c5859f564653d03eddf" name="alsa-oss" arch="ppc64le">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="tiwai@suse.de" date="1398686400">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="fcf7f9706f6c2b10c352d0e1316f45f9cc3471d34aa32b02123e3d2550f7cd05" name="alsa-oss" arch="s390x">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="tiwai@suse.de" date="1398686400">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="caca39bb777f699cdde958ae28319d9145d45ed1f94c371be97cad7ba773fd5f" name="alsa-oss" arch="src">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="ro@suse.de" date="1207828800">- added baselibs.conf file to build xxbit packages
  for multilib support</changelog>
  <changelog author="olh@suse.de" date="1210852800">- remove unneeded Recommends: -64bit on ppc (bnc#390761)</changelog>
  <changelog author="tiwai@suse.de" date="1216123200">- updated to version 1.0.17:
  * just a version bump</changelog>
  <changelog author="jengelh@medozas.de" date="1264593600">- package baselibs.conf</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="tiwai@suse.de" date="1327492800">- updated to version 1.0.25;
  pcm: check for XRUN state for GETxSPACE and GETxPTR ioctls
  select: better check for null bit arrays</changelog>
  <changelog author="reddwarf@opensuse.org" date="1333022400">- stop recommending alsa-oss-32bit</changelog>
  <changelog author="tiwai@suse.de" date="1369310400">- Backport upstream fixes:
  0001-Fix-path-to-libaoss.so.patch
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch</changelog>
  <changelog author="tiwai@suse.de" date="1398686400">- Revert 0001-Fix-path-to-libaoss.so.patch, as this causes
  regressions on multi-arch (bnc#874331)</changelog>
  <changelog author="tiwai@suse.de" date="1398686401">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="f033225d781fbd30e55a46cc5f5de59101dd74348b0533127af58a8df02fccbb" name="alsa-oss" arch="x86_64">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="tiwai@suse.de" date="1398686400">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="eea9296bff00afc940e8c60fd09371f61837e82f309f651b5c5d69ce962ce514" name="alsa-oss-32bit" arch="x86_64">
  <version epoch="0" ver="1.1.8" rel="150300.12.3.2"/>
  <changelog author="tiwai@suse.de" date="1398686400">- Fix for dmix with unaligned sample rate:
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1403092800">- Updated to alsa-oss 1.0.28:
  All pervious fix patches are obsoleted:
  0002-Add-AM_MAINTAINER_MODE-enable-to-configure.in.patch
  0003-Fix-the-argument-passed-to-snd_pcm_dump_setup.patch
  0004-Workaround-for-aoss-dmix-with-unaligned-rates.patch</changelog>
  <changelog author="tiwai@suse.de" date="1522843200">- Update to alsa-oss 1.1.6:
  * Change FSF address (Franklin Street)
- Use %license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1522843201">- Remove old kludges
- Run spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- remove-libio.patch: don't use obsolete &lt;libio.h&gt;</changelog>
  <changelog author="tiwai@suse.de" date="1546948800">- Update to alsa-oss 1.1.8 (bsc#1181571):
  Fix the build with the recent glibc
- Remove obsoleted patch:
  remove-libio.patch:</changelog>
  <changelog author="jengelh@inai.de" date="1547035200">- Avoid repetition of name in summary. Update description.</changelog>
  <changelog author="tiwai@suse.de" date="1574337600">- Fix build breakage by the new alsa update; now it requires
  alsa-topology-devel</changelog>
  <changelog author="tiwai@suse.de" date="1574856000">- Drop the superfluous buildreq alsa-topology-devel again;
  it's no longer mandatory</changelog>
  <changelog author="dmueller@suse.com" date="1614254400">- use https for urls</changelog>
</package>
<package pkgid="ce8f97588132dcdbaeef6f6fdb5dd9b8fe3d05cccf6718f4c45c09806768cc6b" name="amavisd-new" arch="aarch64">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="5218d74c546afc1d75d8c27e3f0ae40a595f533879117c283e129029da96a072" name="amavisd-new" arch="ppc64le">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="57b22da898980e9e48963ada0568172aeb5d199d890fac053dbd5817d07cbfca" name="amavisd-new" arch="s390x">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="f3287ebfc205cce70a5f2b87e7fc5e6fb3e2ee9d292a466a2026d0d2fb7c4701" name="amavisd-new" arch="src">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="varkoly@suse.com" date="1380110400">- bnc#831556 - naming mismatch for amavis and systemd</changelog>
  <changelog author="opensuse@cboltz.de" date="1380801600">- fix clamd socket location (bnc#809580)</changelog>
  <changelog author="varkoly@suse.com" date="1382443200">- bnc#844575 - amavis received a change where /var/run was replaced
  with /run still /var/run is present</changelog>
  <changelog author="wr@rosenauer.org" date="1384257600">- Add real systemd support; add required macros in %post/postun sections
  and drop sysvinit support on openSUSE &gt;= 12.3</changelog>
  <changelog author="wr@rosenauer.org" date="1388577600">- add some recommended decoders (bnc#754852)
- fixed amavisd-milter invocation (bnc#809969)
- correctly set clamd socket to (/var/run/clamav/clamd-socket)
  (bnc#844575)
- some spec file cleanup including using optflags for native code</changelog>
  <changelog author="wr@rosenauer.org" date="1406462400">- update to version 2.9.1
  COMPATIBILITY
  There are no known incompatibilities between versions 2.9.0 and 2.9.1.
  Additional bugfixes and also:
  - updated decoding of RAR archives to recognize a changed format in output
    of 'unrar' utility version 5; based on a patch by amavis17(at)iotti.biz
  - avoid tempfailing a message if a redis server is down, just log the
    error and carry on;
  - some minor logging changes to facilitate troubleshooting;
- changes in 2.9
  COMPATIBILITY
  This version drops dependency on a Perl module Redis, and makes
  dependencies on modules Convert::TNEF and Convert::UUlib truly optional.
  The following change may affect third-party log parsers:
  To facilitate forensic log analysis and troubleshooting, log entries
  'FWD from' and 'SEND from' at level 1 now carry one additional
  prefixed information field which is the unique internal mail_id of
  the message, possibly followed by a parent_mail_id in parenthesis,
  No other incompatibilities with a previous version 2.8.1 are expected.
  NEW FEATURES SUMMARY
  - structured log/reporting to a Redis server in JSON format;
  - IP address reputation (uses a Redis server);
  - added two minor content categories to the major ccat CC_UNCHECKED
    (encrypted (=1) and over-limits/mail-bomb (=2) );
  - introduced a by-recipient setting %final_destiny_maps_by_ccat.
- update amavisd-milter to 1.6.0
  * New features:
    Added new amavisd-milter option -B which passes value of
    {daemon_name} milter macro as amavisd-new policy bank name.
  * Bug and compatibility fixes:
    Added amavisd-milter.spec for compilation with rpmbuild.
    Fixed typo which prevents using LDFLAGS on Debian.
    Fixed missing definition of true and false in libmilter/mfapi.h.
- upstream packages as tar.xz -&gt; added xz as BuildRequires to
  support building for older dists</changelog>
  <changelog author="ro@suse.de" date="1408190400">- add /bin/logger as prereq (util-linux split)</changelog>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="b1cdd83fe815c643706202cac875dec79fa63118c325637659edd7963eff5f61" name="amavisd-new" arch="x86_64">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="3e21115d02b8d74e09e1caf8db8310ae5efda9e0a0631faa932e25c27ea5ec4e" name="amavisd-new-docs" arch="aarch64">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="35b142c989009abae7d5978f079e3ec8753a9f0c01bc0ecee8c2fe3c33c6b1c3" name="amavisd-new-docs" arch="ppc64le">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="80f4a1d51178870c66fb1fecffc203956d0434bbed4024ae8cc6e2e6dfded00d" name="amavisd-new-docs" arch="s390x">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="d4bd4232f1c5224958ff2532f3af2ccc44899df24204fda2c0216ccfd80a207d" name="amavisd-new-docs" arch="x86_64">
  <version epoch="0" ver="2.11.1" rel="150000.6.6.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in post script
- remove '-e' option of 'echo' command that may be unsupported in some
  POSIX-complete shells</changelog>
  <changelog author="p.drouand@gmail.com" date="1418731200">- Update to version 2.10.1
  + fixed a missing import of mail_addr_idn_to_ascii() and idn_to_utf8()
    when SQL is in use
  + void warnings issued by perl 5.21.5:
- Changes from version 2.10
  COMPATIBILITY
- New requirement: perl module Net::LibIDN needs to be installed.
- Uses a perl module File::LibMagic if installed, instead of spawning
  a file(1) utility.
- Support for international email relies heavily on perl to do the
  right thing in its support of Unicode, so using a reasonably recent
  version of perl is recommended. Amavisd was tested with perl 5.18
  and 5.20.1. Versions of perl older than 5.12 may cause problems
  with handling, encoding, and decoding of Unicode characters.
  It is reasonable to expect that versions 5.14 and 5.16 are fine too,
  but have not been tested extensively.
- Default log templates and notification templates have changed
  in details (like in decoding of international e-mail addresses), so
  if locally customized templates are in use these will benefit from
  updating - otherwise expect some mojibake in log and notifications.
- International domain names (IDN) encoded in ASCII-compatible encoding
  found in e-mail addresses and in Message-ID header field will be decoded
  to Unicode for presentation purposes (syslog, JSON structured log,
  notifications). This decoding does not affect a mail message itself.
- Logging via syslog expects that syslogd (or equivalent) will not
  clobber UTF-8 octets. It may be necessary to tell syslogd to accept
  C1 control characters unchanged, e.g. by adding a command line option
  "-8" to syslogd. Failing to do so may leave logged entries (like
  sender and recipient address, From, Subject) in international mail
  garbled or poorly readable in syslog.
  On FreeBSD one should add:  syslogd_flags="-8"  to /etc/rc.conf.
- Third party log parsers may need updating to accept logs with Unicode
  characters in UTF-8 encoding.
- A SMTP response to an EHLO command will now announce SMTPUTF8 capability
  by default.
  BUG FIXES
- releasing a message from an SQL quarantine was broken in version 2.9.1
  due to introduction of parent_mail_id(); patches provided by Stef Simoens
  and Gionatan Danti;
- if checking of a message was aborted prematurely (like due to a timeout
  or some fatal error), JSON log could receive a copy of a previous
  log entry;
- prevent non-ASCII non-UTF-8 octets from reaching a JSON log/report
  (which produced an invalid JSON object and Elasticsearch complaining);
- allow SMTP commands MAIL FROM and RCPT TO to accept options without
  values, as allowed by the RFC 5321 syntax;
- in delivery status notification (DSN) the field Received-From-MTA
  specified 'smtp' as mta-name-type, instead of a 'dns' as prescribed
  in RFC 3464;
- releasing from a quarantine left envelope sender address as '&lt;&gt;'
  instead of using the address found in a Return-Path header field
  of a quarantined message, while also logging a warning:
    Quarantine release $QID: missing X-Envelope-From or Return-Path
  reported by Pascal Volk;
- avoid failure in os_fingerprint or in smtp forwarding in certain cases
  where the $os_fingerprint_method or $forward_method or $notify_method
  uses an asterisk in place of a host IP address or port number.
  The reported error in os_fingerprint (reported by -ben) was:
    os_fingerprint FAILED: Insecure dependency in socket
    while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80
  and in SMTP forwarding or notification (reported by Dennis Boone):
    (!)connect to *:10025 attempt #1:
    Insecure dependency in socket while running with -T switch
    at /usr/lib/perl/5.18/IO/Socket.pm line 80.
- files LDAP.ldif and LDAP.schema: added a missing attribute
  amavisDisclaimerOptions to objectClass; reported by Quanah Gibson-Mount;
  NEW FEATURES
- added support for Internationalized Email:
  * RFC 6530 - Overview and Framework for Internationalized Email
  * RFC 6531 - SMTP Extension for Internationalized Email (SMTPUTF8)
  * RFC 6532 - Internationalized Email Headers
  * RFC 6533 - Internationalized Delivery Status Notifications
  This supports UTF-8 (EAI) in SMTP/LMTP sender addresses, recipient
  addresses, and message header section. Feature parity with Postfix
  version 2.12 (support introduced in development snapshot 20140715).
  The SMTPUTF8 extension is supported by Gmail since 2014-08-05:
    http://googleblog.blogspot.com/2014/08/a-first-step-toward-more-global-email.html
- added support for Internationalized Domain Names (IDN) according
  to IDNA (RFC 5890, RFC 5891; RFC 3490);
  * A-labels in ASCII-compatible encoding of domain names are converted
    to U-labels for presentation/logging purposed;
  * U-labels are converted to A-labels when feeding a mail message
    to an MTA which does not announce support for SMTPUTF8 extension
    (instead of rejecting them as invalid mail address);
  * For lookup purposes an international domain name is converted to
    ASCII-compatible encoding when used as a query key in DNS lookups
    and in lookups into hash, list, SQL and LDAP lookup tables (but not
    in regexp table lookups). These tables are expected to contain domain
    names in their ASCII representation (ACE). For convenience of config
    files subroutines idn_to_ascii() and mail_idn_to_ascii() are available,
    which encode a Unicode domain name to ACE (like ToASCII in RFC 3490);
  * Many configuration settings may have their domain names in UTF-8.
    These will be converted to ACE automatically where necessary
    (e.g. when creating a Received and Authentication-Results header
    fields, DKIM signatures, mail addresses in notifications, ...).
    These settings include:
    $myhostname, $localhost_name, $myauthservid, $mydomain,
    notification sender and recipient mail addresses
    ($mailfrom_notify_*, $hdrfrom_notify_*, @*_admin_maps),
    domain names and selectors in DKIM signing keys (in calls
    to dkim_key() );
- delivery notifications and admin notifications now show the following
  information encoded as UTF-8 (which is a default $bdy_encoding) in the
  plain text part of the message: IDN domain names in sender and recipient
  mail addresses and Message-ID are first decoded to Unicode, Subject and
  author display names are MIME-decoded;
- 'amavisd showkeys' and 'amavisd testkeys' can now deal with IDN
  (international domain names): domain names in DNS zone comments
  end up as UTF-8, DNS labels are in ASCII (A-labels); domain names in
  calls to dkim_key() may be specified either as UTF-8 or in ASCII (ACE);
- new macro 'mail_addr_decode' takes an e-mail address as a string of
  octets, where a local part may be encoded as UTF-8, and the domain part
  may be an international domain name (IDN) consisting either of U-labels
  or A-labels or NR-LDH labels. Decodes A-labels to U-labels in domain
  name. Returns a string of logical characters (Unicode), suitable for
  notification templates. If the mail address is not a valid UTF-8 string,
  it is interpreted as ISO-8859-1 (Latin-1).
- new macro 'mail_addr_decode_octets' is like 'mail_addr_decode', except
  that the result is a string of octets, only valid as UTF-8 if the
  provided address was a valid UTF-8 (garbage-in/garbage-out);
- new macro 'header_field_octets' is like 'header_field', except that
  a result is a string of octets in UTF-8 encoding, suitable for a log
  template;
- new macro 'ip_proto_trace_all' expands into a list of information
  items from a Received header trace; each item consists of a protocol
  name (the WITH clause) and an IP address, optionally followed by a
  source port number if known;
  Example:
    ESMTP://[2001:db8::143:1]:39141 &lt; ESMTP://2001:db8::25 &lt;
    esmtps://203.0.113.172 &lt; ESMTPSA://192.168.9.9
  or:
    UTF8SMTP://[203.0.113.172]:51208 &lt; UTF8SMTPSA://192.168.9.9
- new macro 'ip_proto_trace_public' is like ip_proto_trace_all, except
  that entries with non-public IP address are excluded from the list;
  'Received' trace information in $log_verbose_templ and in notifications
  now include results from this macro call;
- new macro 'protocol' evaluates to a protocol name by which a message
  was received by amavisd, according to RFC 3848 ("Transmission Types
  Registration") and "Mail Transmission Types" / "WITH protocol types"
  IANA registration
    http://www.iana.org/assignments/mail-parameters/mail-parameters.xhtml
  e.g.: SMTP, ESMTP, ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS, LMTPSA,
    UTF8SMTP, UTF8SMTPA, UTF8SMTPS, UTF8SMTPSA,
    UTF8LMTP, UTF8LMTPA, UTF8LMTPS, UTF8LMTPSA, ...
- new macro 'client_protocol' expands into a protocol name by which
  a message was received from a client by MTA; the information is passed
  from MTA to amavisd through XFORWARD PROTO SMTP protocol extension or
  through AM.PDP (milter); typical values are 'ESMTP' or 'SMTP';
- use a perl module File::LibMagic when available, instead of spawning
  a file(1) utility for classifying contents of mail parts.
  By using a direct interface to a libmagic library the startup cost
  of spawning an external process is avoided. Benchmarking shows that
  using libmagic is significantly faster especially for checking a small
  number of files - takes 4 ms for checking one file with libmagic
  vs. 27 ms with a spawned file(1); based on a patch by Markus Benning;
  OTHER
- RFC 6533: recognize a MIME type 'message/global' as similar
  to 'message/rfc822', and 'message/global-headers' as similar
  to 'text/rfc822-headers' where appropriate (e.g. in bounce killer);
- header validity check now distinguishes 'non-ASCII and invalid UTF-8'
  from 'non-ASCII but valid UTF-8' characters in a mail header section.
  By default valid UTF-8 strings in a mail header section are not treated
  as error even if mail is not flagged as international mail (SMTPUTF8),
  as these are quite common in practice. To treat non- MIME-encoded UTF-8
  in a header section as error the test can be enabled by:
    $allowed_header_tests{'utf8'} = 1;
- ORCPT attribute in SMTP 'RCPT TO' command now accepts the original
  recipient mail address in any of these encodings: utf-8-address,
  utf-8-addr-unitext, utf-8-addr-xtext, or as a legacy xtext,
  as required by RFC 6533;
- updated do_cabextract (extraction of Microsoft cabinet .cab archives)
  to recognize a slightly changed output of cabextract version 1.2;
  patch by Thomas Jarosch;
- adjusted some timeouts to leave more reserve for later stages of
  mail processing and forwarding;
- prefer sanitizing/protecting control characters as hex code (like \x7F)
  instead of octal (like \177) (e.g. in logging and DSN);
- Use dowload Url as source
- Add a requirement on perl-Net-LibIDN; new upstream dependency</changelog>
  <changelog author="wr@rosenauer.org" date="1439380800">- require perl-Convert-BinHex as otherwise startup fails with
  default installation
- file based requirement does not work
  - &gt; changed to package requirement util-linux-systemd</changelog>
  <changelog author="aj@ajaissle.de" date="1453377600">- Add amavisd-new-2.10.1-myhostname.patch:
  $myhostname is set using POSIX::uname, but expects a FQDN. This
  patch changes this behaviour to use Net::Domain::hostfqdn instead</changelog>
  <changelog author="jcnengel@gmail.com" date="1464350400">- Update to version 2.11.0
  + Bugfixes
  * delivery method was undefined when always_bcc was used;
  reported by Marieke Janssen;
  * avoid warnings issued by perl 5.21.7 and later:
  Negative repeat count does nothing at ./amavisd line 16408
  and similarly in amavisd-status;
  * releasing from an SQL quarantine failed to provide the original
  envelope sender address to a released message;
  reported, and a fix suggested by Tom Johnson and Tobias;
  * remove a stale database file __db.nanny.db on a reload or restart,
  as it can prevent a successful start when a previous start failed
  for some reason; a patch by Trent Lloyd;
  + Compatibility
  * During startup more detailed testing is performed for taint bugs of
  a module Encode and the function utf8::is_utf8(), which may produce
  warnings on old versions of perl with its old core module Encode,
  or may exit on detecting more sinister bugs in these modules.
  Note that the module Encode may be upgraded independently of perl,
  if desired;
  * with MySQL: changed character set 'utf8' to 'utf8mb4' for fields
  msgs.subject and msgs.from_addr, as previously some of the UTF-8
  characters could not be stored in a database;
  * when logging to stderr a timestamp prefix to each message is only
  still inserted if $DEBUG is true.  When $DEBUG is false each message
  is prefixed with a syslog log level in angle brackets, and a timestamp
  is omitted (for compatibility with systemd);
  * a perl module Digest::SHA is now a required module. It is a perl core
  module since perl 5.10, so it shouldn't introduce a new dependency,
  and it was a de-facto required module even previously, as it was needed
  for DKIM processing;
  + New features
  * Polished rough corners to facilitate running amavisd as a non-daemonized
  supervised process
  * A log template macro 'report_json' can now take arguments, which can
  include or exclude fields (key/values) from the JSON report object.
  Arguments to a macro are either field names (keys) to be included
  in a report, or are field names to be excluded, each prefixed with
  an exclamation mark, to produce a report with all but excluded fields.
  * Two new configuration settings are added: %smtpd_tls_server_options
  and %smtp_tls_client_options. These two associative arrays are passed
  to IO::Socket::SSL-&gt;start_SSL when establishing a server-side or a
  client-side TLS session with an MTA, and provide more control over
  a TLS session - like providing certificates and restricting ciphers.
  See documentation of a perl module IO::Socket::SSL for a list of
  all options with their descriptions and their defaults.
  * Supports receiving SMTP/LMTP connections through a HAProxy,
  recognizing 'PROXY protocol Version 1' data on the first line read,
  after a connection from HAProxy to amavisd has been established.
  Connection data (IP addresses and ports) received via this protocol
  end up replacing such data in the the Amavis::In::Connection object
  ($conn).  Set configuration variable $haproxy_target_enabled (also
  a member of policy banks) to true in order to enable this protocol.
  * redis: allow a scoped / link-local IP address specification
  (avoiding current limitation in IO::Socket::IP [rt.cpan.org #89608]);
  * the Amavis::Unpackers::Part::digest method now holds a digest (SHA1,
  hex) of a decoded (base64 or quoted-printable) MIME part contents,
  followed by a colon and a lowercased Content-Type of the MIME part.
  Canonical line endings CRLF in decoded textual parts are normalized
  to a native newline (\n) before feeding them to a digest algorithm.
  * Policy bank names in a @client_ipaddr_policy setting can now accept
  a comma-separated list of policy names to be loaded on a match
  (for loading of policy banks based on an IP address of a SMTP client).
  Whitespace around each policy name is allowed and is stripped.
  Previously only a single policy bank name was allowed in each entry
  of @client_ipaddr_policy.
  * Experimental feature: IP lookups (as implemented by lookup_ip_acl()
  and used by @client_ipaddr_policy) can now also do DNS-based lookups,
  in addition to array- and hash-based lookups.</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we don't need it.</changelog>
  <changelog author="wr@rosenauer.org" date="1487764800">- fixed DKIM signing by recognizing ORIGINATING
  (regression in 2.11.0) (dkim-signing.diff)
  (https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1515931200">- bnc#1007149 Amavisd-milter fails to start when started via systemd
  Use fillup_only with -n amavis</changelog>
  <changelog author="varkoly@suse.com" date="1521028800">- bsc#1071932 - YaST2 Mail Server Configuration - throws Error for
  starting service amavis.
  amavisd-new should require spamassassin</changelog>
  <changelog author="varkoly@suse.com" date="1521115200">- bsc#1072122 amavisd-new should use unar instead of unrar</changelog>
  <changelog author="wr@rosenauer.org" date="1539518400">- update to version 2.11.1
  * removed a trailing dot element from @INC, as a workaround for a perl
    vulnerability CVE-2016-1238
  * amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR
    for a message "PID &lt;pid&gt; went away", and removed redundant newlines
    from some log messages
  * safe_decode() and safe_decode_utf8(): avoid warning messages
    "Use of uninitialized value in subroutine entry"
    in Encode::MIME::Header when the $check argument is undefined
  * @sa_userconf_maps has been extended to allow loading of per-recipient
    (or per-policy bank, or global) SpamAssassin configuration set from
    LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with
    'ldap:' will load SpamAssassin configuration set using the
    load_scoreonly_ldap() method;  a patch by Atanas Karashenski
  * add some Sanesecurity.Foxhole false positives to the default
    list @virus_name_to_spam_score_maps
  * updated some comments
- update amavis-milter to version 2.6.1
  * Fixed bug when creating amavisd-new policy bank names</changelog>
  <changelog author="varkoly@suse.com" date="1647259200">- amavisd-new: Deprecated option "syslog" used in amavis.service
  (bsc#1185145)
  Remove deprecated entry</changelog>
</package>
<package pkgid="6ac7bf42b68c64cb01b22c1357376fb57357e29225fcd4fff44aa452286662c4" name="amazon-ecs-init" arch="aarch64">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="3d05ccb7f44d4fd62a13686c7b3dd495da1ac360cd7adbe55138505dd822c7f6" name="amazon-ecs-init" arch="src">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="2a4a9511eb7dc17fdfc1b4ed30a13a98ead8a925ce61436836679e1ebae83103" name="amazon-ecs-init" arch="x86_64">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="21d4ce0509b05df2955022e52e764409b95d4d154b044f10225e69268c31b336" name="amazon-ecs-init" arch="aarch64">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="555b81e1c2395b23694f2e14473b80da249fbf0b849e055163b8a75b10c319f1" name="amazon-ecs-init" arch="src">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="b6a59a994e9dee2d499d7c6e6586b40c2d8d5265c188a53631ffa5747ee653bf" name="amazon-ecs-init" arch="x86_64">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="2dd8bc9a1b2a884c1650d01340ff4c9ac660537f304b49011ee833724d11d6a0" name="amazon-ssm-agent" arch="aarch64">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="8cbb45b83a80a3b12dd82d37bf5bde501076c43442796ccaf2babf7c38771687" name="amazon-ssm-agent" arch="ppc64le">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="32eba959605faee26539e203fb3150b06797a2165437757f625cf95c0253b22f" name="amazon-ssm-agent" arch="s390x">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="f546e8d65981c20759eefe6c87e33f43bae22e07fabb1b1a877f57717830eabe" name="amazon-ssm-agent" arch="src">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="15c24d9b5f8f5c2c554b648ecdee78393d267c14bc327e8096cdb0bfc42aa1a7" name="amazon-ssm-agent" arch="x86_64">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="425e1ada660b8ca29f36d853eb925fbae2c3755dd62bc226cd7a960df0596500" name="amazon-ssm-agent" arch="aarch64">
  <version epoch="0" ver="3.1.1260.0" rel="150000.5.9.2"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
</package>
<package pkgid="51e139bf82ace84569217967cc5cf5070c5c5f95291f61e6e30b69797910c146" name="amazon-ssm-agent" arch="src">
  <version epoch="0" ver="3.1.1260.0" rel="150000.5.9.2"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
</package>
<package pkgid="ccf31da6a0a9250ff40d264fa84b396d05fbb95a1b2a638d8fb4bba676a860de" name="amazon-ssm-agent" arch="x86_64">
  <version epoch="0" ver="3.1.1260.0" rel="150000.5.9.2"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
</package>
<package pkgid="1e2510f442e7e5a198a61efffb847c013b77fccfc17f28c9371588cf5a26634d" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="e26aeba455a378cf51823f38429b34ae226d2aad5ef504c83d3527e81a207ed4" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="9e9a30914a0daa97081c30176ec7fac45539121ed441074ec4418ec899a6a035" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="80430cd3b3ccb7a43b1af555816b47c4c02550b84d4f39d235d7da636833a84b" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="f655b2d0b4c01abdee85e987979b3fff66ce338b40a4b5e0085eeec664d18ea2" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="3b87913c32544f3ec23bc6b8bc3faefd881e5b7132fdc27d0e79f2d8eaa3cbf4" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="832bc23d68a64bd1523f1f8397208b950e283299471f9abb8161d81f48379ab2" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="e33403909535f61e00fb4f221a01d42138a67e2a9120d8c5ef1393b4bd0421c2" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="eaee8a2af0334e4cad0f336086acd48c37ae572ba711bcd8b9d38338cf7ab276" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.14.1"/>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
</package>
<package pkgid="2f013b56907847da585c00cfda9a340862ba753535f3e72da2b5c4dd2bcb32ad" name="ansible" arch="src">
  <version epoch="0" ver="2.9.27" rel="150000.1.14.1"/>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
</package>
<package pkgid="544779336d24ad695199c8b3a49441213e3900dbbfd401620cbec25fb0e8eff8" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="d35161ca5800c5bb785bde871bf27a21b13303f9cf55926717f8ed72b6088e27" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="c847c431f8deb8f1372132f973adbe8842c357b8b5e8c24f32c3c20841fd8729" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="1d5be04fe2800ea1c5961070392168b34bc4a5d96a66b8142c66335a8083a777" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="7d32c074d7a724ae180554073347e40552c8ccfbfe2a1a284723a1c94606b6f6" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.14.1"/>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
</package>
<package pkgid="b560ffef2d2f39ecceecf20cdf2f56db65477c5c3873ed359f0d6a3feff117cf" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="110b6a369644482653406e5d67cd98fcdb504e3fcd1150e2432372d6d596686e" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="43974d4be84070e320a2518dd3dcbfafc77903f92e0f5877d5a216fca6b80a6b" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="2a6aa4d0cd6c92e7fdec9ed59f517f6856025e182fb0dbb572e7e710415aaaef" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="e4dacd270878123caca403d263ba3d20722944fc9c227097b9b4287d907d7afc" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.14.1"/>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
</package>
<package pkgid="bdb195933933d68fe04f47001cabced6ab7066d962336e9fdfa9e307b1ef5dc2" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="209a6f728459ff139aaa5deea7c4c4e25725785ce56bb2a6eb579d1e9aae37b3" name="ant" arch="src">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="f5e23bb414b97be6b667653f54a126ab2f608b1a551b86240e4bd93273e95856" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="68366a60d7748bcade62740a352ca02ad43934250f1dceae332cfb28a318c666" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="d8e5a91a74a39e207641450337bacab9f24a2b917856cc51e280f39efb0674f0" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="af2654682bbb8582ab1716b2ad3cf2935f1676e54f672d2619ca75d3c9d08e39" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="71c1e2c5ef14b39a49631c259385ac5603674eef45a462f46f79d7a01186b662" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="4b2760e6aa0d61b414d6a02775ede5c7340f410fd03d4867969ff3eee57de1c0" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="ea9e04369123aad228ae77fbcce3378f326778044682ab23f3146b6456714907" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="f29550da110f1e94628fc229a8cd7fa5d37db3f60b591d966f90fe400dc37af7" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="4080d4c36f41ce8932f49b433edb790a8269a6088637fce4eaabf86ede59717c" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="1b6f6cb96bb146ea204dcdecd958a9ebe275f38794d085a570f4bc4ae675e9b9" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="8677ddb10fdae4eaf2c3397afa88f1dbd3863b57aa561fdbd3f3f19aff08b1be" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="8cccccc7832a0dfd89d00ddaab52d62913c16041b403f8baac390ea7bde1e0ff" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="b17760595254b468e4c1935e99d3997aa904d39843db1e53a82e4ae4332abbe2" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="cae5586dd598a8629fe39af2dd3e9dc68c961d37180eef7f253ba740c41526d6" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="917f1a2286f6d69304e3286de30024a28d0fb3790d225cb31929634a2330e9e4" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="0c466c25d4382abfee2f6ddc433cbf7bcc08477a04501a6cccdf514c55587f5b" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="f58f06cca742b7f03fbc9782467761bd1db6ecb4b6c3cd7f09af8b2005d9eb97" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="8deaaff548a20fe85c4aca9e9dda19060987a37fa6b0a2a4f3a65c5a8c63c845" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="5f8e7bcf63e490fe38902255da966bd5896b50ca15e23616b47d817839534fea" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="3c3d41c558150abfb3877d608d51b29d83c5d7e1a2d8ba236898baa76edf1b3a" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="6a516b547ce6dd3cf12368adde5b0fb733895b193d004cafb54d63b7914cb0ad" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="27fa425f9b455fe3bf41e0b47e9a903a09dd6f60caa2e3171704c56e6a14487c" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="ee24dab757e1db0c19aa517a8f03d7baab5904c381a5af70602e1fbc481cfb93" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="349b3520f0a2a01d83873afd49c7164c1c8f1b15b952fdec7dfb5daf9e0e0c7b" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="0c4b3ecb07a7d5b2ae428b3aee356a2b4ceabe3d2a105b303584cc3ac2995efa" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.7" rel="150200.4.6.1"/>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Modified patch:
  * apache-ant-1.9.9-sourcetarget.patch
  - Build with source/target 8</changelog>
  <changelog author="jsikes@suse.de" date="1535112000">- Update to 1.9.13
  * Fixes a regression in the "get" task where redirects
    from a HTTP resource to a HTTPS resource started throwing
    an exception.
    Bugzilla Report 62499
  * the new allowFilesToEscapeDest didn't work when set to false and
    archive entries contained relative paths with so many ".."
    segnments that the resulting path would go beyond the file system
    root.
    Bugzilla Report 62502, bsc#1100053, CVE-2018-10886</changelog>
  <changelog author="fstrba@suse.com" date="1539777600">- Require javapackages-local in order to generate correctly the
  maven requires and provides
- Install maven artifacts</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1540123200">- Add reproducible-build-manifest.patch: Use less detailed version
  string for manifest's "Created-by" field (boo#1110024).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1540555200">- Update to 1.10.5 [bsc#1113136]
  * Same version as in 1.9.13 but with additional features and
    requires Java8 or higher.
  * Dropped patch to build with java8+ already fixed in this version
  - apache-ant-1.9.9-sourcetarget.patch
  * Refreshed patch:
  - apache-ant-class-path-in-manifest.patch</changelog>
  <changelog author="fstrba@suse.com" date="1540987200">- Add aliases to some maven artifacts so that packages out there
  resolve then correctly</changelog>
  <changelog author="fstrba@suse.com" date="1543233600">- Let ant-antlr provide ant-xz too, since it contains the
  corresponding jar.</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Don't build against a particular xml-apis/xml-resolver provider,
  but against the generic virtual provider. This allows easier
  bootstrapping.
- Added patch:
  * apache-ant-xml-apis.patch
    + look for the xml-apis.jar and xml-resolver.jar when composing
    classpath; they are symlinks provided by several packages.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Build ant against xml-commons-apis-bootstrap and
  xml-commons-resolver-bootstrap in order to break build cycle</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildRequire hamcrest for ant-junit and ant-antlr, since junit4
  depends strictly on hamcrest-core only.</changelog>
  <changelog author="fstrba@suse.com" date="1549627200">- Add compatibility links ant/ant*.jar for bootstrap build</changelog>
  <changelog author="fstrba@suse.com" date="1549627201">- Create an ant-junit5 package to build junit5 optional tasks
  when they become resolved
- Add a simple pom file for ant-bootstrap.jar</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Make "if" statements in build recipe POSIX sh compatible.</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Require directly xerces-j2 and not its virtual provide
  jaxp_parser_impl</changelog>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589544000">- Security fix: [bsc#1171696, CVE-2020-1945]
  * Insecure temporary file vulnerability
- Add patches:
  * ant-CVE-2020-1945-1.patch ant-CVE-2020-1945-2.patch
  * ant-CVE-2020-1945-3.patch ant-CVE-2020-1945-4.patch
  * ant-CVE-2020-1945-5.patch</changelog>
  <changelog author="david.anes@suse.com" date="1648468800">- Security fixes:
  * [CVE-2021-36373, bsc#1188468] excessive memory allocation when
  reading a specially crafted TAR archive
  * [CVE-2021-36374, bsc#1188469] excessive memory allocation when
  reading a specially crafted ZIP archive or a derived formats
- Add patches:
  * ant-CVE-2021-36373-and-CVE-2021-36374.patch</changelog>
</package>
<package pkgid="1183d6108d41d25f3d9cae5321d93646e8d492fdef842adbe54a5272cd7ecfab" name="anthy" arch="aarch64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="f41e9701800e1e0dce84d98fa23c85e67d5e1ec1b33057ac1d70643923750078" name="anthy" arch="ppc64le">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="814169dfa5aa35117e1a7b3d6c989523a98fee3d9f7fa28c12c76a0046e01a0e" name="anthy" arch="s390x">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="fad19b790a25944f4af9d2e89407871c40da56a95d00f824c6b60f9e405d9c24" name="anthy" arch="src">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="meissner@suse.de" date="1323604800">- does not need openldap2 direct dependency, libraries are enough</changelog>
  <changelog author="i@marguerite.su" date="1338724800">- fix sles builds.</changelog>
  <changelog author="coolo@suse.com" date="1359979200">- update license to new format</changelog>
  <changelog author="tiwai@suse.de" date="1373630400">- work around the build error with xemacs 21.5.33</changelog>
  <changelog author="tiwai@suse.de" date="1383739200">- Fix breakage on GNU Emacs on openSUSE 13.1 (bnc#849211)
- Added patch: anthy-use-last-command-event.diff</changelog>
  <changelog author="jengelh@inai.de" date="1401451200">- Drop unused build-time requirements on libpng, libgif, libtiff,
  krb5, openldap2</changelog>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="2917d3dba501b555384a0e594f42deb852e0ea3d7b1bd4a33f4428a97d7bb1c6" name="anthy" arch="x86_64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="9b0db9a67bf951d3525e4d731dd381d5921be91864d122d3b39c5b1a2069a6ab" name="anthy-devel" arch="aarch64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="45a82ca69c55233fbe96347a94b158b96f9a9921c5d8fb859574b8ab54bab7e5" name="anthy-devel" arch="ppc64le">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="2bac17082870ec8d87b2859bc55d1807dc86caacfeca904b3921066992481221" name="anthy-devel" arch="s390x">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="6c92671e476261f45054307dfa48a7a913a1aaa46bf585b5ba11191160f986f4" name="anthy-devel" arch="x86_64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="87e6a1e6acfcfd69daee77673570c5f02d829791f9d0d4a6a849ee4ef12c6f40" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150200.3.12.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1648641600">- security update
- added patches
  fix CVE-2021-30473 [bsc#1185778], aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
  + libaom-CVE-2021-30473.patch</changelog>
</package>
<package pkgid="f8ead7590b911130969da9bb12bf0b2cd2384b277fd18084c5d7e387284a9732" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150200.3.12.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1648641600">- security update
- added patches
  fix CVE-2021-30473 [bsc#1185778], aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
  + libaom-CVE-2021-30473.patch</changelog>
</package>
<package pkgid="951ef435ae00f5b3565a9a166d81c8cce709ca57e7097dbcf121d42111630068" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150200.3.12.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1648641600">- security update
- added patches
  fix CVE-2021-30473 [bsc#1185778], aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
  + libaom-CVE-2021-30473.patch</changelog>
</package>
<package pkgid="b59aa6e03c264f322687ba5fa268831c01ee5d320f73ef9d5997ac4a9cf47596" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150200.3.12.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1648641600">- security update
- added patches
  fix CVE-2021-30473 [bsc#1185778], aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
  + libaom-CVE-2021-30473.patch</changelog>
</package>
<package pkgid="840b94f0ab3ee2467e1104627cc14c3d71659be1dc7e9a5baefb4bcda10a55c1" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="7c8c5cbd3eb969c4586d0a4de66edf5455e42356abc595d00d455d997db1b91e" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="be3a3fe48fbe8b6748ab6920111575609d007705d5934272e02ab0781d2828c4" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="0c53b750637c780c7d7e14f2c955c420f6646655508e515209e77c423201dd61" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="0f2ce8557b562398a1729f3a0b1f30ef11c4f56f41badb6651eb5ecee6ca05a4" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="ac69d7aa3fe61655a5baf86a8f95a5b46fca2a129ba4d335c59340af3d1cd381" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="2e829ba5e2447ddf912666b38b4630e52daa60a67dd5cc34619aa180a4ab01b1" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="1819ab88a7df9bd21ffa01e426a52877b36f986aaca71f7f37de4c29b46c35cf" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="779ee6e3c2c042a010933f0ee8a199c05b563cf7c457763b7e47613c3f8be005" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="3.9.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
</package>
<package pkgid="f8be56067377802f6f7ceba7b14daa269503932a291f18be8200a38c630cd476" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="3.9.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
</package>
<package pkgid="e28f51088e64114814268a070a052710f114e501e2b7f5e9b4017b38a8ccb3ec" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="3.9.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
</package>
<package pkgid="7fb31105a0a0ab0f63048352426a0bb537f7cb1fa085144cf6a2f4747b5d0070" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="3.9.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2020-36129 [bsc#1193356], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
  fix CVE-2020-36131 [bsc#1193365], AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
  fix CVE-2020-36135 [bsc#1193366], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
  + libaom-CVE-2020-36129,36131,36135.patch
  fix CVE-2020-36130 [bsc#1193369], AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
  + libaom-CVE-2020-36130.patch</changelog>
</package>
<package pkgid="f58a77d9f9068512f8eb21846ff3a88a71d15efc7cf86d53da3a7a423725ff72" name="apache-commons-compress" arch="noarch">
  <version epoch="0" ver="1.21" rel="150200.3.7.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="20f8abd362828a0bbd752e5b56f47bea4df55f67dcd49f989b62a33672c400f7" name="apache-commons-compress" arch="src">
  <version epoch="0" ver="1.21" rel="150200.3.7.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="d07376d7cb439486002a8e513373837ba909f1c83929e2b9f933c3cc3b9469c1" name="apache-commons-compress" arch="noarch">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="d283ad8ce415ac687f2a91472e4e994185032a977430efe469abe5597371fcf0" name="apache-commons-compress" arch="src">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="f0ce650460657243bac4c2f0859018c55741974d341be3d3626c5560286390ae" name="apache-commons-compress-javadoc" arch="noarch">
  <version epoch="0" ver="1.21" rel="150200.3.7.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="92dfb78894abee00c77236e60e8675cc273337529ecedf0e0a83ff96eca69873" name="apache-commons-compress-javadoc" arch="noarch">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="f90f06adbbb100e53a805410bdd3acdf049c913f62c9ac51f1b218497bfa2bdb" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="d630e3008ff7927173e8f6bf2a880efb83af69595371e4986f8d24766760f289" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="c54f33c78f108ab8f2c3d8fb640392b35a0308d0bb294b14d450675b8f2806f8" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="cdacda64f01b0927774a22bcbda73ebc56f94dc9fa5e208364431d8cf468b2c0" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="ed655926b70e493b8b7540e294d48188b6239fc0d785b5be6d7ad6b30e79a548" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="350684d52026c9421730af3a3941764f27ddc1c1163506f2613de298b359f374" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="f1dd50a040bec4186cedcc1904872e3c98d6787b17453807a88c9c74db5d2aac" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="45758b1d0c5f949039b55114268b28dc7d8b1ec0b1cdcfe619fab089c0dbff4e" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="37240665f2600e02096fc4e338998de4051fbb5808c140f1722e005dc8e3055f" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="a4eb7c18fe90ba6af5caaffab6239399419558ecdd2a44800e5e0b2571407634" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b3137069b8af1569caf806ae8c98f1ebe359b99de973da0cd3ae952e66457933" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1eadc8afd52b5af7e07a816da73bdc4ad6c08d0ec44518460a23c830fe20aff8" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="6a836a9d06374cad86435d38fa02de6316bfd4a93d1f590a8649b706a771fb49" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="03169866125399cc8c9ea853963c880c9b90a5c7b993c07b60d00e5f1838e56b" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="7f142efa21eaad89b4b08aad7be92b7814ee514d4bc8e5ef95c0c66724a8c714" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="917177d9cc339e1b6c7012d1bb71ff20f7dbcc6ee886e48463bef2d2a02bd247" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="345dd5c6dd38e951095ee83120c896d70870a2ab920fcb579fe8d211ebc0e3ac" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="cacb43e2947f645089994664c9b0c04a91232657a4ef539d845b0152ccbdab89" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="a064c890d2dceaa0231086e6e41cc03346211849cf43741d303113ad3a8e3070" name="apache2" arch="src">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c4c77f1bffa2ba593c9e7e3fb92018de3a771b8675e9192773069420e4849494" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="a8db6c99abbbc10b15adcbab440dd800a6f7b74192a2e6d13fc8ef9aacca155d" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="cce6ec90ead567b414b0a53c3a918ad6976dd381bd7ed8b62a909e5f2d13a63b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="986bb467908ecd00a0298f0a8eeb457b2bca5c849ccf02e6a3b2d268e011b8de" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0f016af186cf064071e97488dea1e96cb8ce032f6acf7335ef8a78e6eb75f258" name="apache2" arch="src">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="70b7dc479d73135747bbd294a69eff6a61da2e8735d65464c1b30297baa134da" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0c88c80c7db001f2d7eb5add5e93da354928db9a8f0de8111fd930e66ff4f590" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="81cf7781a64a30c303d174cfb0b0f7cc3055793c0931b945ec7c504e9677229b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="cd0505e9ddafb28e96fe8a05aba2df624004654f0e9e9462525f920e3bdc8ecb" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="3825063bb660f3fbfeb67cbdbc60aa4083082662e05456b3888fca90010c6703" name="apache2" arch="src">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="09b6e62c3520ce8c113db190363471413facf762125e87166d63a072a180dcba" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="338c7e97839ced516405b1179bdfdaa9fafcb9704497fd2c7db0e768417e6de4" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="85ba6bd3d9cf3acab20fd22f507d66d2a27783cf579ee8816a0505396e23cbd3" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="16e5f45c7263deb93068a026a7d7e86f49e06abd910160a441fa63298c032517" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="773ddf09019b02959e4277ffe801ed9e29119ee3243fcee0dd530c5beb6b7e70" name="apache2" arch="src">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="0a333dc25a82188395a8cdca2196a5f54e97ec4dd5e4da93f37c5962f99c7800" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="fa007a8bdbae35fd6353abe198b4d74fcd8e8d77b84057b7695b29a46094c890" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="9eebea863b1ca5ef5a4f0f1189a2d81bb300d208d3eec4081616ac537edb8425" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="0fc0bd358d0252e59d0908c51a213d7543d153f7adf1335e237c02966dbe7eb8" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="8222762b88125aa0911fa75de527cce4729bd004569f61cc3abaf27d83a5aadc" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="266b268b3ae32d26d51c905ee35608d537d11f61c2c406dccdc6acf652b69520" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="fdfe949230256552b3e25bf5e918b094ef4843cb64ed4e89e1368baf7a4185b9" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="6a7e2441a42ccde2af3f5ad09fa9756bb594cf04dbd7d0a524613b3c27a750b1" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="acfa12f48628b866d41b9c7ae606dde79e2876a269a4d53b8fb62bcedf7a1d7a" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="43f85a7577a4344c010328ccbe5882f8f552ef5c794ae761614b5775d3d0a3d1" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="23f58a31d988c813115fda3d277c393a030e53086fb4f99e323a8fa4308c5291" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="80396128752e9ae4a7d13b5d90bcbc7de4f0b98dacb877a82645355d674060ea" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1ee7e31cca3b20149cd19e8b85c60b5819dd8817e5dd35bb86463e62ab7e71f7" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1707f477784c1b1401bf11edcf2528f3d0547af42c965cc92ab6411b84436e6e" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="e26ea76f4d5e009957eef064d506e2bebecaf28b5face2c42eec896b8c6e98fe" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="2f071b3060cce116ac118b131bc17115fd1e86c38c09585a31615007ca9edff2" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0626802d2781c28dde3b710ae1e1dd1a9e9ed4d7846b926e48a0d61b9c662903" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="819525ace15e8643e7d91bdc5171837abc5c123fde5ea4456d8a69a851a314fb" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="23a26981ce6f9acd2d5e6febef4f850d215cd52e2db1ad3dfb9d48376b3b1713" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="e56355f28c448f359ab0f273e896d1c79641e0783512f8037ad6528828a0892b" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="9238e786e01b1e523f0d4f61383905474685b382824cc0f28c9c3cba14875a6a" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="76ef0826a75913f30b7ef177fb330bd1e9030055d58851bcf81b79da2ca84ed9" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="9449605ab5a58bb6e9d0b30877b5623724d31de5e9d5e59849c9ab14255c4c4c" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="dcab8ee49f0619763745511ced326dae8fa87dfe1217df1c2bc296c09331202a" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="28621e3e7b531419d07e852a3dbd0145fc242e743b05772dbbbd11f422a1e6aa" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="d30b2d5e97cabfcf3b083f048e44be605735ae53ba49213d0a2aa3ed2a2b0207" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="ae2834aba9867b8d86f2a8f1dd0bec55c0ca31895a2297179320b2e7963adf6e" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="23bbbd4baf33a378cd9032fefcddfe4753f3256ccafd4b1b21674c679b966ae7" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="eceba7636a78c91d5856ac1c7e80f4332cfb775cacd015d4a3764876cf159f34" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="dd5e58c9e128d5b1de6808774d42f75e1633fe405d52c9b1afc0e873fe62b777" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="aa142dcadb32c83a1c9e2542c0a3e24639d2255d248cd9219c88f3931b66f711" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="a0837f2e3a9047d4c41f2ae18525dc399aa5ee78b70c661474b27927202bef2e" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="c7a237fc8f51d42d147a783ba135e10ff246e44133aa675767e06516ffaec295" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="b5570fc6ffe1217f056c95661c3640df499ebc7c7b5da3e6953918aec65d46ec" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c95c0d6b7176fb6541c73f9afcb6350d03a2f9ea5802f596cea256ee4fbc9c46" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="2162f34933f48e73545c75a31ea6d391319c98f89696edef1e72b41315e220c2" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="cc68ae25ae00646960b70876d4d9201e1c91602c6c7c5280b786b544dadf1617" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="2513b9bd085689beb043483366ba7f867b9f303bc5ab82f9db2698e89fb57172" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="1b5f8ea5a0928bb474d3237302fcf90406286a58754d36370f496f7d8f0fbb99" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="362b95a6dabfc0584d8f539471b9107363a20cea32f43ba850daea2f362ad08c" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="23b3fe827877b7d3faa78b6e211d30abf97c4d6a0a1aa5a40afe4bb9a8c015ca" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="905703e6dded423308aba321e1d68d072144db13fe62336e3438a3265e5a66fb" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b6edfc37b94e9faed4ecfa25c58b682b2971d8627e253eedbcf69ac43e64c006" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b115d0a690df94f0d438a7bcc5af3891d36eb7d690e59cba5723ebd7a05fd612" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ba95dafb3321c500d2ae8b00b701e73de1d9d16dbb8bd26875c3d86cc14bcd12" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1c83493ca93d670b821eef964036a06142682a2f88d14d6ca545901e68714fe0" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="cc15e287b8112bd8e91bee649ab3ca2ebc69b9e43171f79156f103bb444d3ef5" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="9826fe805510e20390cfc6dcd59d2cd3d3f153f4a5857c5b3d50197dfcf09f23" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="53dc094212c2d94a761835c19d4201590aeb786cea3deeed6ec74a1e5d67d585" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="f2621d1fa92ae6c0283ca8f0d03d27fd6f3e7554e4ba2f8fc25b374d5d08f7f5" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c26d305de561f9ebf7434a2aac73ad67704c1fd6ae178ae42e2ad3f30bf394d1" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="cb76a9176f4a902db6bad2a839d0afb329fa31bb0b8edc402ee9e1b310fdff51" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0bac90f852d16cb51fb5eaa0a02ee343d900187ad4b5f1ef3e8e7185354c4ee7" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c30805ad917c0eaefec6cee07a4a220ab56631a8c2391edf8feb42b72aa384d3" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="f6e0365d06eeb40738c3bd5a74bf74195f15f91666011d54db4083d5c9047204" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="84f04e38cb7f8c567c94390d36ce0e92e125c5c2b9ea53b5c85d30b17f916972" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="bda535145f79ee941fd698a47b3a648922d7d77800445ab9c257b688b48d88f1" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="f734b15fc0cf5ea15d56d89e2ebae27fdd9f5c4b4d3461332b4f0268962ccb1d" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="c211900e3af73235c835aba51deba07525df5a32f7311b66718962bb27a00b83" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="06249c7b0ca40ce024b9623ddf4896e95e65edad151b39f83ff10a72e91491d0" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="ca1ca34919d2c5af2500c0f57c932c76bc4c293de1c2b0cf43a2ee1a92028427" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="aa29c0a3214da326cdabbd9675a8f6a00e41321a8bf8b1479d53890ffdc3fb40" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="fe9ecbeb0795d0c4ef8fa5f27e90073b460afd494f8d14cf493e4dbb02635e92" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="c6ab2b4cc2d7fafec1527939ecc361b384bc4169ea2352d7d335f89822c975a4" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="095bb282a8ba45adfbe92aa3a11418a89952facaf14557ff8a331e604f66d929" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="46e6aac8baa1379b31e5704081a86fa368981fd2675ef18eab3f9f58481d3bd1" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="24645aaf0ced9924dc52ffcd99ac4f98c8b43fcf843bb712428f223910f756dd" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="e139688eddab7707f16213c9e41dc2d39c4b3bd2cedd40d79067090ac359fdce" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="831634fce424ffbb0fecab21afa32f99136006da6fa2b4fa8e26fff24e7146af" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="2cf38f681ddca8aa10f1b7bc390f416c7399e25eaab33b04dcdbde32d8c979c1" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="7dca5f7bd6e5aff2898f184cd3b9bb164da3f91f0174f173aaeb24363721bb53" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="3ae57eec25792b45b696e86a5fe047ae1a63e28915967876df7bff7e89326eef" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b5bec053e8162b7a9116a950e5fffed53c09d0bed0449897d01906fb492ee352" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="a38df8ed029c1e6d05e0e3345c4e0e3d1b7eea0bbe7b96b4e95adbc2ff532c98" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="b6685bd18c83e7f0bdb809201aa271bd26700ca399fb0da4f33bf70b00a8df46" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="397615f6bbb26c0e95404c474627533051fedaa9e78ac1e09c05a5c50c24973a" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="011453c60bccb35c2d79ef0269afa8b1b5a3b9cc2fa20e804973b46aace2a863" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="89db42708ae6fc5d607f06191766bafbec22a42b739e820e859a0bf3c06e3cc9" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="971c9d2b8fc21c3df22ac79c1867f0fb1c5558ea946e30e3cecf5e8b7be914bf" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0153d930e8b0143a3309459c30440b76e22f96547f2eae15a1e79126ac2c4d16" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="40d1d397e117ca98df562d91c1ecba00ec4c6392ad8031b9bdc4871ce6d746f1" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="de380b7444176928c634a11a15ec26e7d96e68dc7d5c03e59726d1d5dfc64aa2" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c5a38e466442331dc813c636bf091619ad599eedc62652cc2f83044199bcc8ac" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="65e1ac35ca774b0a74e554b2dcb7196607397d2751b6f69e178a5e24177a023f" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="3f8c55a97eafb8134c774f3bf6a1abce85561ddeb96e778df62504859a8b7051" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="87d8f255837801567287b8b292c6eb864f51fa20a981260de2099eef2b9e1502" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="22737450bf55ca6a74afd772efe5c5186d0e956abe008e3972bc5b0696a213f9" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="05e28b3a37a9075164bb1ce4c9158e280a745efb7ebc7d2a533068a7bc989558" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="0b75ec8eef5de5716296e103041e9d200bebc31a3546be6af56d4ab71d8e6e57" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="47bb8ebb2409760581d78000cba4919f289e2d73326c71bdac1a6b47e3e2bb57" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="83b15817624007f1eae6139778362ad0c20009bff4d8fc9549610e68942824bb" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="2e02e979abefd3b356d53b276db6f5d65ddf74f8d3fa92d363f8ffa59dc4c647" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="4b5f3d7e8d2389e6c6e34529f8015c1ce0ca58ec77e9327f44f8799bd9451753" name="apache2-mod_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="2e4ebc9ef2f22beb565e1facb189eb8454b809e724fa407680389e68d308ef44" name="apache2-mod_apparmor" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="81c0c432a2ef546043920b15c58f0e45273f5cf109d24ea969bf5277f208da4b" name="apache2-mod_apparmor" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="0072df5bf6191567d8d768bcc26c4ffe63f2061b73fc408ba0a8fe10ca891df7" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="f2ac956d1815fb54e15155b3105ac22dd597e6ce00a88fa489f84233a0b856d5" name="apache2-mod_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="2407ed3e296b181ccbfaf0352cd8660db7a2eccf0fe83cc1277a82ac1a78c51f" name="apache2-mod_apparmor" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="bebed1fcb7e6db28d873c8bdac9412edb1d262f709932d2ed47be0f109b1052a" name="apache2-mod_apparmor" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="80954a3575164b800669e2278ed6fe52f187dffb4c98a5488ebcb663effb854a" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="5480d632af54e2c24f179c0e4e5920b2087876ed52b52008fbc7f942ffd34828" name="apache2-mod_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="5f332869694ce2e37cdd925f38df900ce888f218142c3b102a61120d2d11d23c" name="apache2-mod_apparmor" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="884ea130cd20593923e1864c42da836b5a16a782d2347b9542c6558bd3c85a82" name="apache2-mod_apparmor" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="15ffbe6872222f8a162933e5b6e7afd10dc0f499783c7c762a3a42c37454e9d7" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="265957de6a54834de3aee5fb9071ec48d8d3040c8f4afaf84ff6688100aada81" name="apache2-mod_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="33c9b2304e33a0700b97f63109e0cbb5cad259865e01ea0a4f3bf9ff9e171ff6" name="apache2-mod_apparmor" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="65b382fc3904f54559eac6018ec7971212761f2287761d5b4f7f80e663f00379" name="apache2-mod_apparmor" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="a0045fda4acf8dc537de6359bccdff2da248b08cc21f91d2b3d15c5ebb8f3f05" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="545cb05cfda1f55af5ee8557a01d65d54137f55b2f42319bd4528ad9ff8427ec" name="apache2-mod_auth_mellon" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="63369427456ad4caef5de5de7a2a5c458ca16843f23042b3013d984c7b6e8e4f" name="apache2-mod_auth_mellon" arch="ppc64le">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="1fad638b2be66dc647624d911e008c9fade06b40949e082b3416d172c5565d47" name="apache2-mod_auth_mellon" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="a58af25c76528322c7f166fad8994bd692315ba188ea7dd8a3d1d1604ca80dcf" name="apache2-mod_auth_mellon" arch="src">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="b712cc8fed15b282a884d9d2dd0d987f9956c3fe7f337d670b42826d8928a003" name="apache2-mod_auth_mellon" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="1c103d69a4e353690acf73a93f258ad1a008dd09cafb85e10ab13c7294762f3c" name="apache2-mod_auth_mellon" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="cb67651eee59049c96a6406a455daed9725dff346a07a698b3837920dc172ac4" name="apache2-mod_auth_mellon" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="3703d7126bca6b434409dfba849396fc6c7cf14d874c1f8e3d41ba833e7f6d2d" name="apache2-mod_auth_mellon" arch="src">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="6fd7f83416c3170ed9f563edb38ef0db709e1ed55dc7428c701edbc7934f8b69" name="apache2-mod_auth_mellon" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="5a3cde485177a716bb1edd1a3d686f9cfbebb5cc5cbf687c766da815579f27e5" name="apache2-mod_auth_mellon-diagnostics" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="f449c5b37f051a5b7f0db041c96e2c7f2c50a9fcf83ee933df211dd953e5e0f0" name="apache2-mod_auth_mellon-diagnostics" arch="ppc64le">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="287e5bbb635b6dbc8be86977b31e1b26c69b7c13bae2f2c745fa1b03d235f37a" name="apache2-mod_auth_mellon-diagnostics" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="880d310db3995b0a5b0731c10c77a96e2f625cf2984eb942921d33eca80cb92a" name="apache2-mod_auth_mellon-diagnostics" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="47d0d22d5dfb25e8f8182180696c893a3626cfd643512421075d3d1841ec921c" name="apache2-mod_auth_mellon-diagnostics" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="b88491366f336c2c32b8df5c6d0a239a0ec385a2e23f62476054644e618c7197" name="apache2-mod_auth_mellon-diagnostics" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="18b073856739c1a6ab8eb4c1e50b89e215f828f22ec7463e716983e8450274b5" name="apache2-mod_auth_mellon-diagnostics" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="2e8a13c913be6a887195b2eb51f97062f4d97317f62dc207db684d5ff424cb14" name="apache2-mod_auth_mellon-doc" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="08168788705ac25e17511261fbca5033ce9fb4e8fae3bc7148420d73d44c08d1" name="apache2-mod_auth_mellon-doc" arch="ppc64le">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="b1b02413ac3641e0e12637780711ddbc8600dab35633c2000e8f0e33c2fac53f" name="apache2-mod_auth_mellon-doc" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="53f98c5ce5ddddfddc63f897931fa199ca2644fcb8a457d089dcb91a77540412" name="apache2-mod_auth_mellon-doc" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="150200.5.7.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905601">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="e7b19e8446049708296f9878d393edb666c6c43915ac037cad487af00e20fc19" name="apache2-mod_auth_mellon-doc" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="47f44719e70e4b00541f6ed121c19fcea654b33fd7992dbaf0cfd6d49d966c4f" name="apache2-mod_auth_mellon-doc" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="d55c9cbb05c5c2a48ed944c119f277fe83106250213cf1293d3c0939d9b2250b" name="apache2-mod_auth_mellon-doc" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="66bf463df8eeaa8e9000bdf1e0a925020b2c09d0148c50403a48ea2f621b99cd" name="apache2-mod_auth_openidc" arch="aarch64">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="d113cfc8bb1704e8e82dc9ca4085faa4353a7acee5f20aa34c997f14b9d1c5fb" name="apache2-mod_auth_openidc" arch="ppc64le">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="c4b686c2a687f4ca83aa2fb59af2d55b0f63b3ed928a230fb38af62ab7c11c4f" name="apache2-mod_auth_openidc" arch="s390x">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="5534b9a93837148d60e081488f0faa3e96c78593c82374a0ef72988951dc6e1e" name="apache2-mod_auth_openidc" arch="src">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="79db50c41107b982c3fbed62973875945e1d12679b2d43bb35b2fe9ce53ce467" name="apache2-mod_auth_openidc" arch="x86_64">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="0c6557bf9ea88d466a271cbdc35a437bed1fe76061d2830f4cc64e6492e6519d" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.33" rel="150200.3.46.2"/>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __?allStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
  Version 7.4.25
  21 Oct 2021
    DOM:
    Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
    FFI:
    Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).
    Fileinfo:
    Fixed bug #78987 (High memory usage during encoding detection).
    Filter:
    Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
    FPM:
    Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
    SPL:
    Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
    Streams:
    Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
    XML:
    Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
    Zip:
    Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
    Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).
  Version 7.4.24
  23 Sep 2021
    Core:
    Fixed bug #81302 (Stream position after stream filter removed).
    Fixed bug #81346 (Non-seekable streams don't update position after write).
    Fixed bug #73122 (Integer Overflow when concatenating strings). (CVE-2017-8923)
    GD:
    Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).
    Opcache:
    Fixed bug #81353 (segfault with preloading and statically bound closure).
    Shmop:
    Fixed bug #81407 (shmop_open won't attach and causes php to crash).
    Standard:
    Fixed bug #71542 (disk_total_space does not work with relative paths).
    Fixed bug #81400 (Unterminated string in dns_get_record() results).
    SysVMsg:
    Fixed bug #78819 (Heap Overflow in msg_send).
    XML:
    Fixed bug #81351 (xml_parse may fail, but has no error code).
    Zip:
    Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
  Version 7.4.23
  26 Aug 2021
    Core:
    Fixed bug #72595 (php_output_handler_append illegal write access).
    Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).
    Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).
    BCMath:
    Fixed bug #78238 (BCMath returns "-0").
    CGI:
    Fixed bug #80849 (HTTP Status header truncation).
    GD:
    Fixed bug #51498 (imagefilledellipse does not work for large circles).
    MySQLi:
    Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).
    OpenSSL:
    Fixed bug #81327 (Error build openssl extension on php 7.4.22).
    PDO_ODBC:
    Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).
    Phar:
    Fixed bug #81211: Symlinks are followed when creating PHAR archive.(cmb)
    Shmop:
    Fixed bug #81283 (shmop can't read beyond 2147483647 bytes).
    Standard:
    Fixed bug #72146 (Integer overflow on substr_replace).
    Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
    Fixed bug #74960 (Heap buffer overflow via str_repeat).
    Streams:
    Fixed bug #81294 (Segfault when removing a filter).
  Version 7.4.22
  29 Jul 2021
    Core:
    Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
    Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
    Fixed bug #80728 (PHP built-in web server resets timeout when it can kill the process).
    Fixed bug #73630 (Built-in Webserver - overwrite $_SERVER['request_uri']).
    Fixed bug #80173 (Using return value of zend_assign_to_variable() is not safe).
    Fixed bug #73226 (--r[fcez] always return zero exit code).
    Intl:
    Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
    Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone).
    Fixed bug #74264 (grapheme_strrpos() broken for negative offsets).
    OpenSSL:
    Fixed bug #52093 (openssl_csr_sign truncates $serial).
    PCRE:
    Fixed bug #81101 (PCRE2 10.37 shows unexpected result).
    Fixed bug #81243 (Too much memory is allocated for preg_replace()).
    Standard:
    Fixed bug #81223 (flock() only locks first byte of file).
  Version 7.4.21
  01 Jul 2021
    Core:
    Fixed bug #81068 (Double free in realpath_cache_clean()).
    Fixed bug #76359 (open_basedir bypass through adding "..").
    Fixed bug #81090 (Typed property performance degradation with .= operator).
    Fixed bug #81070 (Integer underflow in memory limit comparison).
    Fixed bug #81122 (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
    Bzip2:
    Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).
    OpenSSL:
    Fixed bug #76694 (native Windows cert verification uses CN as server name).
    PDO_Firebird:
    Fixed bug #76448 (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
    Fixed bug #76449 (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
    Fixed bug #76450 (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
    Fixed bug #76452 (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
    Standard:
    Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
  Version 7.4.20
  03 Jun 2021
    Core:
    Fixed bug #80929 (Method name corruption related to repeated calls to call_user_func_array).
    Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
    Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
    Fixed bug #80972 (Memory exhaustion on invalid string offset).
    FPM:
    Fixed bug #65800 (Events port mechanism).
    FTP:
    Fixed bug #80901 (Info leak in ftp extension).
    Fixed bug #79100 (Wrong FTP error messages).
    GD:
    Fixed bug #81032 (GD install is affected by external libgd installation).
    MBString:
    Fixed bug #81011 (mb_convert_encoding removes references from arrays).
    ODBC:
    Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator).
    PDO_MySQL:
    Fixed bug #81037 (PDO discards error message text from prepared statement).
    PDO_ODBC:
    Fixed bug #44643 (bound parameters ignore explicit type definitions).
    pgsql:
    Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
    SPL:
    Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
    Opcache:
    Fixed bug #80900 (switch statement behavior inside function).
    Fixed bug #81015 (Opcache optimization assumes wrong part of ternary operator in if-condition).
    XMLReader:
    Fixed bug #73246 (XMLReader: encoding length not checked).
    Zip:
    Fixed bug #80863 (ZipArchive::extractTo() ignores references).
  Version 7.4.19
  06 May 2021
    PDO_pgsql:
    Reverted bug fix for #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
  Version 7.4.18
  29 Apr 2021
    Core:
    Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
    Fixed bug #75776 (Flushing streams with compression filter is broken).
    Dba:
    Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN).
    DOM:
    Fixed bug #66783 (UAF when appending DOMDocument to element).
    FPM:
    Fixed bug #80024 (Duplication of info about inherited socket after pool removing).
    FTP:
    Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open).
    Imap:
    Fixed bug #80710 (imap_mail_compose() header injection).
    Intl:
    Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
    LibXML:
    Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers).
    Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8).
    MySQLnd:
    Fixed bug #80713 (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
    Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an error).
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    Opcache:
    Fixed bug #80805 (create simple class and get error in opcache.so).
    Fixed bug #80950 (Variables become null in if statements).
    Pcntl:
    Fixed bug #79812 (Potential integer overflow in pcntl_exec()).
    PCRE:
    Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
    PDO_ODBC:
    Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
    PDO_pgsql:
    Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
    phpdbg:
    Fixed bug #80757 (Exit code is 0 when could not open file).
    Session:
    Fixed bug #80774 (session_name() problem with backslash).
    Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
    SOAP:
    Fixed bug #69668 (SOAP special XML characters in namespace URIs not encoded).
    Standard:
    Fixed bug #78719 (http wrapper silently ignores long Location headers).
    Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI).
    Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
    Fixed bug #80915 (Taking a reference to $_SERVER hides its values from phpinfo()).
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.16
  04 Mar 2021
    Core:
    Fixed bug #80706 (mail(): Headers after Bcc headers may be ignored).
    MySQLnd:
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Standard:
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.15
  04 Feb 2021
    Core:
    Fixed bug #80523 (bogus parse error on &gt;4GB source code).
    Fixed bug #80384 (filter buffers entire read until file closed).
    Curl:
    Fixed bug #80595 (Resetting POSTFIELDS to empty array breaks request).
    Date:
    Fixed bug #80376 (last day of the month causes runway cpu usage.
    MySQLi:
    Fixed bug #67983 (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
    Fixed bug #64638 (Fetching resultsets from stored procedure with cursor fails).
    Fixed bug #72862 (segfault using prepared statements on stored procedures that use a cursor).
    Fixed bug #77935 (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
    Phar:
    Fixed bug #77565 (Incorrect locator detection in ZIP-based phars).
    Fixed bug #69279 (Compressed ZIP Phar extractTo() creates garbage files).
    SOAP:
    Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702)
  Version 7.4.14
  07 Jan 2021
    Core:
    Fixed bug #74558 (Can't rebind closure returned by Closure::fromCallable()).
    Fixed bug #80345 (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
    Fixed bug #72964 (White space not unfolded for CC/Bcc headers).
    Fixed bug #80362 (Running dtrace scripts can cause php to crash).
    Fixed bug #80393 (Build of PHP extension fails due to configuration gap with libtool).
    Fixed bug #80402 (configure filtering out -lpthread).
    Fixed bug #77069 (stream filter loses final block of data).
    Fileinfo:
    Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT).
    FPM:
    Fixed bug #69625 (FPM returns 200 status on request without SCRIPT_FILENAME env).
    Intl:
    Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined).
    OpenSSL:
    Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
    Phar:
    Fixed bug #73809 (Phar Zip parse crash - mmap fail).
    Fixed bug #75102 (`PharData` says invalid checksum for valid tar).
    Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
    PDO MySQL:
    Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
    Fixed bug #63185 (nextRowset() ignores MySQL errors with native prepared statements).
    Fixed bug #78152 (PDO::exec() - Bad error handling with multiple commands).
    Fixed bug #70066 (Unexpected "Cannot execute queries while other unbuffered queries").
    Fixed bug #71145 (Multiple statements in init command triggers unbuffered query error).
    Fixed bug #76815 (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
    Standard:
    Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
    Fixed bug #80366 (Return Value of zend_fstat() not Checked).
    Fixed bug #80411 (References to null-serialized object break serialize()).
    Tidy:
    Fixed bug #77594 (ob_tidyhandler is never reset).
    Zlib:
    Fixed bug #48725 (Support for flushing in zlib stream).
  Version 7.4.13
  26 Nov 2020
    Core:
    Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
    Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
    COM:
    Fixed bug #62474 (com_event_sink crashes on certain arguments).
    DOM:
    Fixed bug #80268 (loadHTML() truncates at NUL bytes).
    FFI:
    Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
    IMAP:
    Fixed bug #64076 (imap_sort() does not return FALSE on failure).
    Fixed bug #76618 (segfault on imap_reopen).
    Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
    Fixed minor regression caused by fixing bug #80220.
    Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
    MySQLi:
    Fixed bug #79375 (mysqli_store_result does not report error from lock wait timeout).
    Fixed bug #76525 (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
    Fixed bug #72413 (mysqlnd segfault (fetch_row second parameter typemismatch)).
    ODBC:
    Fixed bug #44618 (Fetching may rely on uninitialized data).
    Opcache:
    Fixed bug #79643 (PHP with Opcache crashes when a file with specific name is included).
    Fixed run-time binding of preloaded dynamically declared function.
    OpenSSL:
    Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
    PDO MySQL:
    Fixed bug #66528 (No PDOException or errorCode if database becomes unavailable before PDO::commit).
    Fixed bug #65825 (PDOStatement::fetch() does not throw exception on broken server connection).
    SNMP:
    Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
    Standard:
    Fixed bug #80266 (parse_url silently drops port number 0).
  Version 7.4.12
  29 Oct 2020
    Core:
    Fixed bug #80061 (Copying large files may have suboptimal performance).
    Fixed bug #79423 (copy command is limited to size of file it can copy).
    Fixed bug #80126 (Covariant return types failing compilation).
    Fixed bug #80186 (Segfault when iterating over FFI object).
    Calendar:
    Fixed bug #80185 (jdtounix() fails after 2037).
    IMAP:
    Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
    Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
    Fixed bug #80220 (imap_mail_compose() may leak memory).
    Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
    Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
    Fixed bug #80226 (imap_sort() leaks sortpgm memory).
    MySQLnd:
    Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
    Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
    ODBC:
    Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
    Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
    Fixed bug #80150 (Failure to fetch error message).
    Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
    Fixed bug #46050 (odbc_next_result corrupts prepared resource).
    OPcache:
    Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
    Fixed bug #80194 (Assertion failure during block assembly of unreachable free with leading nop).
    PCRE:
    Updated to PCRE 10.35.
    Fixed bug #80118 (Erroneous whitespace match with JIT only).
    PDO_ODBC:
    Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
    Standard:
    Fixed bug #80114 (parse_url does not accept URLs with port 0).
    Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
    Fixed bug #76735 (Incorrect message in fopen on invalid mode).
    Tidy:
    Fixed bug #77040 (tidyNode::isHtml() is completely broken).
  Version 7.4.11
  01 Oct 2020
    Core:
    Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
    Fixed bug #79979 (passing value to by-ref param via CUFA crashes).
    Fixed bug #80037 (Typed property must not be accessed before initialization when __get() declared).
    Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
    Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
    Calendar:
    Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
    COM:
    Fixed bug #64130 (COM obj parameters passed by reference are not updated).
    OPcache:
    Fixed bug #80002 (calc free space for new interned string is wrong).
    Fixed bug #80046 (FREE for SWITCH_STRING optimized away).
    Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
    OpenSSL:
    Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
    PDO:
    Fixed bug #80027 (Terrible performance using $query-&gt;fetch on queries with many bind parameters).
    SOAP:
    Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
    Standard:
    Fixed bug #79986 (str_ireplace bug with diacritics characters).
    Fixed bug #80077 (getmxrr test bug).
    Fixed bug #72941 (Modifying bucket-&gt;data by-ref has no effect any longer).
    Fixed bug #80067 (Omitting the port in bindto setting errors).
  Version 7.4.10
  03 Sep 2020
    Core:
    Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
    Fixed bug #77932 (File extensions are case-sensitive).
    Fixed bug #79806 (realpath() erroneously resolves link to link).
    Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
    Fixed bug #79919 (Stack use-after-scope in define()).
    Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
    Fixed bug #79947 (Memory leak on invalid offset type in compound assignment).
    COM:
    Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
    Exif:
    Fixed bug #75785 (Many errors from exif_read_data).
    Gettext:
    Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
    LDAP:
    Fixed memory leaks.
    OPcache:
    Fixed bug #73060 (php failed with error after temp folder cleaned up).
    Fixed bug #79917 (File cache segfault with a static variable in inherited method).
    PDO:
    Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
    Session:
    Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
    Standard:
    Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
    Fixed bug #79944 (getmxrr always returns true on Alpine linux).
    Fixed bug #79951 (Memory leak in str_replace of empty string).
    XML:
    Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).
  Version 7.4.9
  06 Aug 2020
    Apache:
    Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
    COM:
    Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
    Fixed bug #63527 (DCOM does not work with Username, Password parameter).
    Core:
    Fixed bug #79740 (serialize() and unserialize() methods can not be called statically).
    Fixed bug #79783 (Segfault in php_str_replace_common).
    Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
    Fixed bug #79779 (Assertion failure when assigning property of string offset by reference).
    Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
    Fixed bug #78598 (Changing array during undef index RW error segfaults).
    Fixed bug #79784 (Use after free if changing array during undef var during array write fetch).
    Fixed bug #79793 (Use after free if string used in undefined index warning is changed).
    Fixed bug #79862 (Public non-static property in child should take priority over private static).
    Fixed bug #79877 (getimagesize function silently truncates after a null byte) (cmb)
    Fileinfo:
    Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
    FTP:
    Fixed bug #55857 (ftp_size on large files).
    Mbstring:
    Fixed bug #79787 (mb_strimwidth does not trim string).
    Phar:
    Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
    Reflection:
    Fixed bug #79487 (::getStaticProperties() ignores property modifications).
    Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
    Fixed bug #79820 (Use after free when type duplicated into ReflectionProperty gets resolved).
    Standard:
    Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
    Fixed bug #78008 (dns_check_record() always return true on Alpine).
    Fixed bug #79839 (array_walk() does not respect property types).
  Version 7.4.8
  09 Jul 2020
    Core:
    Fixed bug #79595 (zend_init_fpu() alters FPU precision).
    Fixed bug #79650 (php-win.exe 100% cpu lockup).
    Fixed bug #79668 (get_defined_functions(true) may miss functions).
    Fixed bug #79683 (Fake reflection scope affects __toString()).
    Fixed possibly unsupported timercmp() usage.
    Exif:
    Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
    Fileinfo:
    Fixed bug #79681 (mime_content_type/finfo returning incorrect mimetype).
    Filter:
    Fixed bug #73527 (Invalid memory access in php_filter_strip).
    GD:
    Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
    OpenSSL:
    Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
    PDO SQLite:
    Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
    phpdbg:
    Fixed bug #73926 (phpdbg will not accept input on restart execution).
    Fixed bug #73927 (phpdbg fails with windows error prompt at "watch array").
    Fixed several mostly Windows related phpdbg bugs.
    SPL:
    Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
    Standard:
    Fixed bug #74267 (segfault with streams and invalid data).
  Version 7.4.7
  11 Jun 2020
    Core:
    Fixed bug #79599 (coredump in set_error_handler).
    Fixed bug #79566 (Private SHM is not private on Windows).
    Fixed bug #79489 (.user.ini does not inherit).
    Fixed bug #79600 (Regression in 7.4.6 when yielding an array based generator).
    Fixed bug #79657 ("yield from" hangs when invalid value encountered).
    FFI:
    Fixed bug #79571 (FFI: var_dumping unions may segfault).
    GD:
    Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
    MySQLnd:
    Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
    Opcache:
    Fixed bug #79588 (Boolean opcache settings ignore on/off values).
    Fixed bug #79548 (Preloading segfault with inherited method using static variable).
    Fixed bug #79603 (RTD collision with opcache).
    Standard:
    Fixed bug #79561 (dns_get_record() fails with DNS_ALL).
- fixes [bsc#1203867] and [bsc#1203870]
- modified patches
  % php-no-build-date.patch (refreshed)
  % php7-arm-build-fixes.patch (refreshed)
- deleted patches
  - php-fix_net-snmp_disable_MD5.patch (upstreamed)
  - php-odbc-cmp-int-cast.patch (not needed,
    dropped from factory as well, see
    last comment of
    https://bugs.php.net/bug.php?id=52554)
  - php7-CVE-2017-8923.patch (upstreamed)
  - php7-CVE-2020-7068.patch (upstreamed)
  - php7-CVE-2020-7069.patch (upstreamed)
  - php7-CVE-2020-7070.patch (upstreamed)
  - php7-CVE-2020-7071.patch (upstreamed)
  - php7-CVE-2021-21702.patch (upstreamed)
  - php7-CVE-2021-21703.patch (upstreamed)
  - php7-CVE-2021-21704.patch (upstreamed)
  - php7-CVE-2021-21705.patch (upstreamed)
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
</package>
<package pkgid="b3cfea3a1e0a7bae7dcd6c99d9e16c8810c8d41a9662a1c357a604217fb4fd45" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.33" rel="150200.3.46.2"/>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __?allStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
  Version 7.4.25
  21 Oct 2021
    DOM:
    Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
    FFI:
    Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).
    Fileinfo:
    Fixed bug #78987 (High memory usage during encoding detection).
    Filter:
    Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
    FPM:
    Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
    SPL:
    Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
    Streams:
    Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
    XML:
    Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
    Zip:
    Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
    Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).
  Version 7.4.24
  23 Sep 2021
    Core:
    Fixed bug #81302 (Stream position after stream filter removed).
    Fixed bug #81346 (Non-seekable streams don't update position after write).
    Fixed bug #73122 (Integer Overflow when concatenating strings). (CVE-2017-8923)
    GD:
    Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).
    Opcache:
    Fixed bug #81353 (segfault with preloading and statically bound closure).
    Shmop:
    Fixed bug #81407 (shmop_open won't attach and causes php to crash).
    Standard:
    Fixed bug #71542 (disk_total_space does not work with relative paths).
    Fixed bug #81400 (Unterminated string in dns_get_record() results).
    SysVMsg:
    Fixed bug #78819 (Heap Overflow in msg_send).
    XML:
    Fixed bug #81351 (xml_parse may fail, but has no error code).
    Zip:
    Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
  Version 7.4.23
  26 Aug 2021
    Core:
    Fixed bug #72595 (php_output_handler_append illegal write access).
    Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).
    Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).
    BCMath:
    Fixed bug #78238 (BCMath returns "-0").
    CGI:
    Fixed bug #80849 (HTTP Status header truncation).
    GD:
    Fixed bug #51498 (imagefilledellipse does not work for large circles).
    MySQLi:
    Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).
    OpenSSL:
    Fixed bug #81327 (Error build openssl extension on php 7.4.22).
    PDO_ODBC:
    Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).
    Phar:
    Fixed bug #81211: Symlinks are followed when creating PHAR archive.(cmb)
    Shmop:
    Fixed bug #81283 (shmop can't read beyond 2147483647 bytes).
    Standard:
    Fixed bug #72146 (Integer overflow on substr_replace).
    Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
    Fixed bug #74960 (Heap buffer overflow via str_repeat).
    Streams:
    Fixed bug #81294 (Segfault when removing a filter).
  Version 7.4.22
  29 Jul 2021
    Core:
    Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
    Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
    Fixed bug #80728 (PHP built-in web server resets timeout when it can kill the process).
    Fixed bug #73630 (Built-in Webserver - overwrite $_SERVER['request_uri']).
    Fixed bug #80173 (Using return value of zend_assign_to_variable() is not safe).
    Fixed bug #73226 (--r[fcez] always return zero exit code).
    Intl:
    Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
    Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone).
    Fixed bug #74264 (grapheme_strrpos() broken for negative offsets).
    OpenSSL:
    Fixed bug #52093 (openssl_csr_sign truncates $serial).
    PCRE:
    Fixed bug #81101 (PCRE2 10.37 shows unexpected result).
    Fixed bug #81243 (Too much memory is allocated for preg_replace()).
    Standard:
    Fixed bug #81223 (flock() only locks first byte of file).
  Version 7.4.21
  01 Jul 2021
    Core:
    Fixed bug #81068 (Double free in realpath_cache_clean()).
    Fixed bug #76359 (open_basedir bypass through adding "..").
    Fixed bug #81090 (Typed property performance degradation with .= operator).
    Fixed bug #81070 (Integer underflow in memory limit comparison).
    Fixed bug #81122 (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
    Bzip2:
    Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).
    OpenSSL:
    Fixed bug #76694 (native Windows cert verification uses CN as server name).
    PDO_Firebird:
    Fixed bug #76448 (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
    Fixed bug #76449 (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
    Fixed bug #76450 (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
    Fixed bug #76452 (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
    Standard:
    Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
  Version 7.4.20
  03 Jun 2021
    Core:
    Fixed bug #80929 (Method name corruption related to repeated calls to call_user_func_array).
    Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
    Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
    Fixed bug #80972 (Memory exhaustion on invalid string offset).
    FPM:
    Fixed bug #65800 (Events port mechanism).
    FTP:
    Fixed bug #80901 (Info leak in ftp extension).
    Fixed bug #79100 (Wrong FTP error messages).
    GD:
    Fixed bug #81032 (GD install is affected by external libgd installation).
    MBString:
    Fixed bug #81011 (mb_convert_encoding removes references from arrays).
    ODBC:
    Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator).
    PDO_MySQL:
    Fixed bug #81037 (PDO discards error message text from prepared statement).
    PDO_ODBC:
    Fixed bug #44643 (bound parameters ignore explicit type definitions).
    pgsql:
    Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
    SPL:
    Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
    Opcache:
    Fixed bug #80900 (switch statement behavior inside function).
    Fixed bug #81015 (Opcache optimization assumes wrong part of ternary operator in if-condition).
    XMLReader:
    Fixed bug #73246 (XMLReader: encoding length not checked).
    Zip:
    Fixed bug #80863 (ZipArchive::extractTo() ignores references).
  Version 7.4.19
  06 May 2021
    PDO_pgsql:
    Reverted bug fix for #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
  Version 7.4.18
  29 Apr 2021
    Core:
    Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
    Fixed bug #75776 (Flushing streams with compression filter is broken).
    Dba:
    Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN).
    DOM:
    Fixed bug #66783 (UAF when appending DOMDocument to element).
    FPM:
    Fixed bug #80024 (Duplication of info about inherited socket after pool removing).
    FTP:
    Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open).
    Imap:
    Fixed bug #80710 (imap_mail_compose() header injection).
    Intl:
    Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
    LibXML:
    Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers).
    Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8).
    MySQLnd:
    Fixed bug #80713 (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
    Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an error).
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    Opcache:
    Fixed bug #80805 (create simple class and get error in opcache.so).
    Fixed bug #80950 (Variables become null in if statements).
    Pcntl:
    Fixed bug #79812 (Potential integer overflow in pcntl_exec()).
    PCRE:
    Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
    PDO_ODBC:
    Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
    PDO_pgsql:
    Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
    phpdbg:
    Fixed bug #80757 (Exit code is 0 when could not open file).
    Session:
    Fixed bug #80774 (session_name() problem with backslash).
    Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
    SOAP:
    Fixed bug #69668 (SOAP special XML characters in namespace URIs not encoded).
    Standard:
    Fixed bug #78719 (http wrapper silently ignores long Location headers).
    Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI).
    Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
    Fixed bug #80915 (Taking a reference to $_SERVER hides its values from phpinfo()).
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.16
  04 Mar 2021
    Core:
    Fixed bug #80706 (mail(): Headers after Bcc headers may be ignored).
    MySQLnd:
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Standard:
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.15
  04 Feb 2021
    Core:
    Fixed bug #80523 (bogus parse error on &gt;4GB source code).
    Fixed bug #80384 (filter buffers entire read until file closed).
    Curl:
    Fixed bug #80595 (Resetting POSTFIELDS to empty array breaks request).
    Date:
    Fixed bug #80376 (last day of the month causes runway cpu usage.
    MySQLi:
    Fixed bug #67983 (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
    Fixed bug #64638 (Fetching resultsets from stored procedure with cursor fails).
    Fixed bug #72862 (segfault using prepared statements on stored procedures that use a cursor).
    Fixed bug #77935 (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
    Phar:
    Fixed bug #77565 (Incorrect locator detection in ZIP-based phars).
    Fixed bug #69279 (Compressed ZIP Phar extractTo() creates garbage files).
    SOAP:
    Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702)
  Version 7.4.14
  07 Jan 2021
    Core:
    Fixed bug #74558 (Can't rebind closure returned by Closure::fromCallable()).
    Fixed bug #80345 (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
    Fixed bug #72964 (White space not unfolded for CC/Bcc headers).
    Fixed bug #80362 (Running dtrace scripts can cause php to crash).
    Fixed bug #80393 (Build of PHP extension fails due to configuration gap with libtool).
    Fixed bug #80402 (configure filtering out -lpthread).
    Fixed bug #77069 (stream filter loses final block of data).
    Fileinfo:
    Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT).
    FPM:
    Fixed bug #69625 (FPM returns 200 status on request without SCRIPT_FILENAME env).
    Intl:
    Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined).
    OpenSSL:
    Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
    Phar:
    Fixed bug #73809 (Phar Zip parse crash - mmap fail).
    Fixed bug #75102 (`PharData` says invalid checksum for valid tar).
    Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
    PDO MySQL:
    Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
    Fixed bug #63185 (nextRowset() ignores MySQL errors with native prepared statements).
    Fixed bug #78152 (PDO::exec() - Bad error handling with multiple commands).
    Fixed bug #70066 (Unexpected "Cannot execute queries while other unbuffered queries").
    Fixed bug #71145 (Multiple statements in init command triggers unbuffered query error).
    Fixed bug #76815 (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
    Standard:
    Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
    Fixed bug #80366 (Return Value of zend_fstat() not Checked).
    Fixed bug #80411 (References to null-serialized object break serialize()).
    Tidy:
    Fixed bug #77594 (ob_tidyhandler is never reset).
    Zlib:
    Fixed bug #48725 (Support for flushing in zlib stream).
  Version 7.4.13
  26 Nov 2020
    Core:
    Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
    Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
    COM:
    Fixed bug #62474 (com_event_sink crashes on certain arguments).
    DOM:
    Fixed bug #80268 (loadHTML() truncates at NUL bytes).
    FFI:
    Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
    IMAP:
    Fixed bug #64076 (imap_sort() does not return FALSE on failure).
    Fixed bug #76618 (segfault on imap_reopen).
    Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
    Fixed minor regression caused by fixing bug #80220.
    Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
    MySQLi:
    Fixed bug #79375 (mysqli_store_result does not report error from lock wait timeout).
    Fixed bug #76525 (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
    Fixed bug #72413 (mysqlnd segfault (fetch_row second parameter typemismatch)).
    ODBC:
    Fixed bug #44618 (Fetching may rely on uninitialized data).
    Opcache:
    Fixed bug #79643 (PHP with Opcache crashes when a file with specific name is included).
    Fixed run-time binding of preloaded dynamically declared function.
    OpenSSL:
    Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
    PDO MySQL:
    Fixed bug #66528 (No PDOException or errorCode if database becomes unavailable before PDO::commit).
    Fixed bug #65825 (PDOStatement::fetch() does not throw exception on broken server connection).
    SNMP:
    Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
    Standard:
    Fixed bug #80266 (parse_url silently drops port number 0).
  Version 7.4.12
  29 Oct 2020
    Core:
    Fixed bug #80061 (Copying large files may have suboptimal performance).
    Fixed bug #79423 (copy command is limited to size of file it can copy).
    Fixed bug #80126 (Covariant return types failing compilation).
    Fixed bug #80186 (Segfault when iterating over FFI object).
    Calendar:
    Fixed bug #80185 (jdtounix() fails after 2037).
    IMAP:
    Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
    Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
    Fixed bug #80220 (imap_mail_compose() may leak memory).
    Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
    Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
    Fixed bug #80226 (imap_sort() leaks sortpgm memory).
    MySQLnd:
    Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
    Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
    ODBC:
    Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
    Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
    Fixed bug #80150 (Failure to fetch error message).
    Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
    Fixed bug #46050 (odbc_next_result corrupts prepared resource).
    OPcache:
    Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
    Fixed bug #80194 (Assertion failure during block assembly of unreachable free with leading nop).
    PCRE:
    Updated to PCRE 10.35.
    Fixed bug #80118 (Erroneous whitespace match with JIT only).
    PDO_ODBC:
    Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
    Standard:
    Fixed bug #80114 (parse_url does not accept URLs with port 0).
    Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
    Fixed bug #76735 (Incorrect message in fopen on invalid mode).
    Tidy:
    Fixed bug #77040 (tidyNode::isHtml() is completely broken).
  Version 7.4.11
  01 Oct 2020
    Core:
    Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
    Fixed bug #79979 (passing value to by-ref param via CUFA crashes).
    Fixed bug #80037 (Typed property must not be accessed before initialization when __get() declared).
    Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
    Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
    Calendar:
    Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
    COM:
    Fixed bug #64130 (COM obj parameters passed by reference are not updated).
    OPcache:
    Fixed bug #80002 (calc free space for new interned string is wrong).
    Fixed bug #80046 (FREE for SWITCH_STRING optimized away).
    Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
    OpenSSL:
    Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
    PDO:
    Fixed bug #80027 (Terrible performance using $query-&gt;fetch on queries with many bind parameters).
    SOAP:
    Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
    Standard:
    Fixed bug #79986 (str_ireplace bug with diacritics characters).
    Fixed bug #80077 (getmxrr test bug).
    Fixed bug #72941 (Modifying bucket-&gt;data by-ref has no effect any longer).
    Fixed bug #80067 (Omitting the port in bindto setting errors).
  Version 7.4.10
  03 Sep 2020
    Core:
    Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
    Fixed bug #77932 (File extensions are case-sensitive).
    Fixed bug #79806 (realpath() erroneously resolves link to link).
    Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
    Fixed bug #79919 (Stack use-after-scope in define()).
    Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
    Fixed bug #79947 (Memory leak on invalid offset type in compound assignment).
    COM:
    Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
    Exif:
    Fixed bug #75785 (Many errors from exif_read_data).
    Gettext:
    Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
    LDAP:
    Fixed memory leaks.
    OPcache:
    Fixed bug #73060 (php failed with error after temp folder cleaned up).
    Fixed bug #79917 (File cache segfault with a static variable in inherited method).
    PDO:
    Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
    Session:
    Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
    Standard:
    Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
    Fixed bug #79944 (getmxrr always returns true on Alpine linux).
    Fixed bug #79951 (Memory leak in str_replace of empty string).
    XML:
    Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).
  Version 7.4.9
  06 Aug 2020
    Apache:
    Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
    COM:
    Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
    Fixed bug #63527 (DCOM does not work with Username, Password parameter).
    Core:
    Fixed bug #79740 (serialize() and unserialize() methods can not be called statically).
    Fixed bug #79783 (Segfault in php_str_replace_common).
    Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
    Fixed bug #79779 (Assertion failure when assigning property of string offset by reference).
    Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
    Fixed bug #78598 (Changing array during undef index RW error segfaults).
    Fixed bug #79784 (Use after free if changing array during undef var during array write fetch).
    Fixed bug #79793 (Use after free if string used in undefined index warning is changed).
    Fixed bug #79862 (Public non-static property in child should take priority over private static).
    Fixed bug #79877 (getimagesize function silently truncates after a null byte) (cmb)
    Fileinfo:
    Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
    FTP:
    Fixed bug #55857 (ftp_size on large files).
    Mbstring:
    Fixed bug #79787 (mb_strimwidth does not trim string).
    Phar:
    Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
    Reflection:
    Fixed bug #79487 (::getStaticProperties() ignores property modifications).
    Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
    Fixed bug #79820 (Use after free when type duplicated into ReflectionProperty gets resolved).
    Standard:
    Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
    Fixed bug #78008 (dns_check_record() always return true on Alpine).
    Fixed bug #79839 (array_walk() does not respect property types).
  Version 7.4.8
  09 Jul 2020
    Core:
    Fixed bug #79595 (zend_init_fpu() alters FPU precision).
    Fixed bug #79650 (php-win.exe 100% cpu lockup).
    Fixed bug #79668 (get_defined_functions(true) may miss functions).
    Fixed bug #79683 (Fake reflection scope affects __toString()).
    Fixed possibly unsupported timercmp() usage.
    Exif:
    Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
    Fileinfo:
    Fixed bug #79681 (mime_content_type/finfo returning incorrect mimetype).
    Filter:
    Fixed bug #73527 (Invalid memory access in php_filter_strip).
    GD:
    Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
    OpenSSL:
    Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
    PDO SQLite:
    Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
    phpdbg:
    Fixed bug #73926 (phpdbg will not accept input on restart execution).
    Fixed bug #73927 (phpdbg fails with windows error prompt at "watch array").
    Fixed several mostly Windows related phpdbg bugs.
    SPL:
    Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
    Standard:
    Fixed bug #74267 (segfault with streams and invalid data).
  Version 7.4.7
  11 Jun 2020
    Core:
    Fixed bug #79599 (coredump in set_error_handler).
    Fixed bug #79566 (Private SHM is not private on Windows).
    Fixed bug #79489 (.user.ini does not inherit).
    Fixed bug #79600 (Regression in 7.4.6 when yielding an array based generator).
    Fixed bug #79657 ("yield from" hangs when invalid value encountered).
    FFI:
    Fixed bug #79571 (FFI: var_dumping unions may segfault).
    GD:
    Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
    MySQLnd:
    Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
    Opcache:
    Fixed bug #79588 (Boolean opcache settings ignore on/off values).
    Fixed bug #79548 (Preloading segfault with inherited method using static variable).
    Fixed bug #79603 (RTD collision with opcache).
    Standard:
    Fixed bug #79561 (dns_get_record() fails with DNS_ALL).
- fixes [bsc#1203867] and [bsc#1203870]
- modified patches
  % php-no-build-date.patch (refreshed)
  % php7-arm-build-fixes.patch (refreshed)
- deleted patches
  - php-fix_net-snmp_disable_MD5.patch (upstreamed)
  - php-odbc-cmp-int-cast.patch (not needed,
    dropped from factory as well, see
    last comment of
    https://bugs.php.net/bug.php?id=52554)
  - php7-CVE-2017-8923.patch (upstreamed)
  - php7-CVE-2020-7068.patch (upstreamed)
  - php7-CVE-2020-7069.patch (upstreamed)
  - php7-CVE-2020-7070.patch (upstreamed)
  - php7-CVE-2020-7071.patch (upstreamed)
  - php7-CVE-2021-21702.patch (upstreamed)
  - php7-CVE-2021-21703.patch (upstreamed)
  - php7-CVE-2021-21704.patch (upstreamed)
  - php7-CVE-2021-21705.patch (upstreamed)
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
</package>
<package pkgid="25e0354fff0b7d93eee8d67795fa2cd6c07cdafa38fa339fa11e906f9b4b3237" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.33" rel="150200.3.46.2"/>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __?allStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
  Version 7.4.25
  21 Oct 2021
    DOM:
    Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
    FFI:
    Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).
    Fileinfo:
    Fixed bug #78987 (High memory usage during encoding detection).
    Filter:
    Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
    FPM:
    Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
    SPL:
    Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
    Streams:
    Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
    XML:
    Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
    Zip:
    Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
    Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).
  Version 7.4.24
  23 Sep 2021
    Core:
    Fixed bug #81302 (Stream position after stream filter removed).
    Fixed bug #81346 (Non-seekable streams don't update position after write).
    Fixed bug #73122 (Integer Overflow when concatenating strings). (CVE-2017-8923)
    GD:
    Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).
    Opcache:
    Fixed bug #81353 (segfault with preloading and statically bound closure).
    Shmop:
    Fixed bug #81407 (shmop_open won't attach and causes php to crash).
    Standard:
    Fixed bug #71542 (disk_total_space does not work with relative paths).
    Fixed bug #81400 (Unterminated string in dns_get_record() results).
    SysVMsg:
    Fixed bug #78819 (Heap Overflow in msg_send).
    XML:
    Fixed bug #81351 (xml_parse may fail, but has no error code).
    Zip:
    Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
  Version 7.4.23
  26 Aug 2021
    Core:
    Fixed bug #72595 (php_output_handler_append illegal write access).
    Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).
    Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).
    BCMath:
    Fixed bug #78238 (BCMath returns "-0").
    CGI:
    Fixed bug #80849 (HTTP Status header truncation).
    GD:
    Fixed bug #51498 (imagefilledellipse does not work for large circles).
    MySQLi:
    Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).
    OpenSSL:
    Fixed bug #81327 (Error build openssl extension on php 7.4.22).
    PDO_ODBC:
    Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).
    Phar:
    Fixed bug #81211: Symlinks are followed when creating PHAR archive.(cmb)
    Shmop:
    Fixed bug #81283 (shmop can't read beyond 2147483647 bytes).
    Standard:
    Fixed bug #72146 (Integer overflow on substr_replace).
    Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
    Fixed bug #74960 (Heap buffer overflow via str_repeat).
    Streams:
    Fixed bug #81294 (Segfault when removing a filter).
  Version 7.4.22
  29 Jul 2021
    Core:
    Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
    Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
    Fixed bug #80728 (PHP built-in web server resets timeout when it can kill the process).
    Fixed bug #73630 (Built-in Webserver - overwrite $_SERVER['request_uri']).
    Fixed bug #80173 (Using return value of zend_assign_to_variable() is not safe).
    Fixed bug #73226 (--r[fcez] always return zero exit code).
    Intl:
    Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
    Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone).
    Fixed bug #74264 (grapheme_strrpos() broken for negative offsets).
    OpenSSL:
    Fixed bug #52093 (openssl_csr_sign truncates $serial).
    PCRE:
    Fixed bug #81101 (PCRE2 10.37 shows unexpected result).
    Fixed bug #81243 (Too much memory is allocated for preg_replace()).
    Standard:
    Fixed bug #81223 (flock() only locks first byte of file).
  Version 7.4.21
  01 Jul 2021
    Core:
    Fixed bug #81068 (Double free in realpath_cache_clean()).
    Fixed bug #76359 (open_basedir bypass through adding "..").
    Fixed bug #81090 (Typed property performance degradation with .= operator).
    Fixed bug #81070 (Integer underflow in memory limit comparison).
    Fixed bug #81122 (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
    Bzip2:
    Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).
    OpenSSL:
    Fixed bug #76694 (native Windows cert verification uses CN as server name).
    PDO_Firebird:
    Fixed bug #76448 (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
    Fixed bug #76449 (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
    Fixed bug #76450 (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
    Fixed bug #76452 (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
    Standard:
    Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
  Version 7.4.20
  03 Jun 2021
    Core:
    Fixed bug #80929 (Method name corruption related to repeated calls to call_user_func_array).
    Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
    Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
    Fixed bug #80972 (Memory exhaustion on invalid string offset).
    FPM:
    Fixed bug #65800 (Events port mechanism).
    FTP:
    Fixed bug #80901 (Info leak in ftp extension).
    Fixed bug #79100 (Wrong FTP error messages).
    GD:
    Fixed bug #81032 (GD install is affected by external libgd installation).
    MBString:
    Fixed bug #81011 (mb_convert_encoding removes references from arrays).
    ODBC:
    Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator).
    PDO_MySQL:
    Fixed bug #81037 (PDO discards error message text from prepared statement).
    PDO_ODBC:
    Fixed bug #44643 (bound parameters ignore explicit type definitions).
    pgsql:
    Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
    SPL:
    Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
    Opcache:
    Fixed bug #80900 (switch statement behavior inside function).
    Fixed bug #81015 (Opcache optimization assumes wrong part of ternary operator in if-condition).
    XMLReader:
    Fixed bug #73246 (XMLReader: encoding length not checked).
    Zip:
    Fixed bug #80863 (ZipArchive::extractTo() ignores references).
  Version 7.4.19
  06 May 2021
    PDO_pgsql:
    Reverted bug fix for #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
  Version 7.4.18
  29 Apr 2021
    Core:
    Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
    Fixed bug #75776 (Flushing streams with compression filter is broken).
    Dba:
    Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN).
    DOM:
    Fixed bug #66783 (UAF when appending DOMDocument to element).
    FPM:
    Fixed bug #80024 (Duplication of info about inherited socket after pool removing).
    FTP:
    Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open).
    Imap:
    Fixed bug #80710 (imap_mail_compose() header injection).
    Intl:
    Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
    LibXML:
    Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers).
    Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8).
    MySQLnd:
    Fixed bug #80713 (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
    Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an error).
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    Opcache:
    Fixed bug #80805 (create simple class and get error in opcache.so).
    Fixed bug #80950 (Variables become null in if statements).
    Pcntl:
    Fixed bug #79812 (Potential integer overflow in pcntl_exec()).
    PCRE:
    Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
    PDO_ODBC:
    Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
    PDO_pgsql:
    Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
    phpdbg:
    Fixed bug #80757 (Exit code is 0 when could not open file).
    Session:
    Fixed bug #80774 (session_name() problem with backslash).
    Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
    SOAP:
    Fixed bug #69668 (SOAP special XML characters in namespace URIs not encoded).
    Standard:
    Fixed bug #78719 (http wrapper silently ignores long Location headers).
    Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI).
    Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
    Fixed bug #80915 (Taking a reference to $_SERVER hides its values from phpinfo()).
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.16
  04 Mar 2021
    Core:
    Fixed bug #80706 (mail(): Headers after Bcc headers may be ignored).
    MySQLnd:
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Standard:
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.15
  04 Feb 2021
    Core:
    Fixed bug #80523 (bogus parse error on &gt;4GB source code).
    Fixed bug #80384 (filter buffers entire read until file closed).
    Curl:
    Fixed bug #80595 (Resetting POSTFIELDS to empty array breaks request).
    Date:
    Fixed bug #80376 (last day of the month causes runway cpu usage.
    MySQLi:
    Fixed bug #67983 (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
    Fixed bug #64638 (Fetching resultsets from stored procedure with cursor fails).
    Fixed bug #72862 (segfault using prepared statements on stored procedures that use a cursor).
    Fixed bug #77935 (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
    Phar:
    Fixed bug #77565 (Incorrect locator detection in ZIP-based phars).
    Fixed bug #69279 (Compressed ZIP Phar extractTo() creates garbage files).
    SOAP:
    Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702)
  Version 7.4.14
  07 Jan 2021
    Core:
    Fixed bug #74558 (Can't rebind closure returned by Closure::fromCallable()).
    Fixed bug #80345 (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
    Fixed bug #72964 (White space not unfolded for CC/Bcc headers).
    Fixed bug #80362 (Running dtrace scripts can cause php to crash).
    Fixed bug #80393 (Build of PHP extension fails due to configuration gap with libtool).
    Fixed bug #80402 (configure filtering out -lpthread).
    Fixed bug #77069 (stream filter loses final block of data).
    Fileinfo:
    Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT).
    FPM:
    Fixed bug #69625 (FPM returns 200 status on request without SCRIPT_FILENAME env).
    Intl:
    Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined).
    OpenSSL:
    Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
    Phar:
    Fixed bug #73809 (Phar Zip parse crash - mmap fail).
    Fixed bug #75102 (`PharData` says invalid checksum for valid tar).
    Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
    PDO MySQL:
    Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
    Fixed bug #63185 (nextRowset() ignores MySQL errors with native prepared statements).
    Fixed bug #78152 (PDO::exec() - Bad error handling with multiple commands).
    Fixed bug #70066 (Unexpected "Cannot execute queries while other unbuffered queries").
    Fixed bug #71145 (Multiple statements in init command triggers unbuffered query error).
    Fixed bug #76815 (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
    Standard:
    Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
    Fixed bug #80366 (Return Value of zend_fstat() not Checked).
    Fixed bug #80411 (References to null-serialized object break serialize()).
    Tidy:
    Fixed bug #77594 (ob_tidyhandler is never reset).
    Zlib:
    Fixed bug #48725 (Support for flushing in zlib stream).
  Version 7.4.13
  26 Nov 2020
    Core:
    Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
    Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
    COM:
    Fixed bug #62474 (com_event_sink crashes on certain arguments).
    DOM:
    Fixed bug #80268 (loadHTML() truncates at NUL bytes).
    FFI:
    Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
    IMAP:
    Fixed bug #64076 (imap_sort() does not return FALSE on failure).
    Fixed bug #76618 (segfault on imap_reopen).
    Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
    Fixed minor regression caused by fixing bug #80220.
    Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
    MySQLi:
    Fixed bug #79375 (mysqli_store_result does not report error from lock wait timeout).
    Fixed bug #76525 (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
    Fixed bug #72413 (mysqlnd segfault (fetch_row second parameter typemismatch)).
    ODBC:
    Fixed bug #44618 (Fetching may rely on uninitialized data).
    Opcache:
    Fixed bug #79643 (PHP with Opcache crashes when a file with specific name is included).
    Fixed run-time binding of preloaded dynamically declared function.
    OpenSSL:
    Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
    PDO MySQL:
    Fixed bug #66528 (No PDOException or errorCode if database becomes unavailable before PDO::commit).
    Fixed bug #65825 (PDOStatement::fetch() does not throw exception on broken server connection).
    SNMP:
    Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
    Standard:
    Fixed bug #80266 (parse_url silently drops port number 0).
  Version 7.4.12
  29 Oct 2020
    Core:
    Fixed bug #80061 (Copying large files may have suboptimal performance).
    Fixed bug #79423 (copy command is limited to size of file it can copy).
    Fixed bug #80126 (Covariant return types failing compilation).
    Fixed bug #80186 (Segfault when iterating over FFI object).
    Calendar:
    Fixed bug #80185 (jdtounix() fails after 2037).
    IMAP:
    Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
    Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
    Fixed bug #80220 (imap_mail_compose() may leak memory).
    Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
    Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
    Fixed bug #80226 (imap_sort() leaks sortpgm memory).
    MySQLnd:
    Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
    Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
    ODBC:
    Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
    Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
    Fixed bug #80150 (Failure to fetch error message).
    Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
    Fixed bug #46050 (odbc_next_result corrupts prepared resource).
    OPcache:
    Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
    Fixed bug #80194 (Assertion failure during block assembly of unreachable free with leading nop).
    PCRE:
    Updated to PCRE 10.35.
    Fixed bug #80118 (Erroneous whitespace match with JIT only).
    PDO_ODBC:
    Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
    Standard:
    Fixed bug #80114 (parse_url does not accept URLs with port 0).
    Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
    Fixed bug #76735 (Incorrect message in fopen on invalid mode).
    Tidy:
    Fixed bug #77040 (tidyNode::isHtml() is completely broken).
  Version 7.4.11
  01 Oct 2020
    Core:
    Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
    Fixed bug #79979 (passing value to by-ref param via CUFA crashes).
    Fixed bug #80037 (Typed property must not be accessed before initialization when __get() declared).
    Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
    Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
    Calendar:
    Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
    COM:
    Fixed bug #64130 (COM obj parameters passed by reference are not updated).
    OPcache:
    Fixed bug #80002 (calc free space for new interned string is wrong).
    Fixed bug #80046 (FREE for SWITCH_STRING optimized away).
    Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
    OpenSSL:
    Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
    PDO:
    Fixed bug #80027 (Terrible performance using $query-&gt;fetch on queries with many bind parameters).
    SOAP:
    Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
    Standard:
    Fixed bug #79986 (str_ireplace bug with diacritics characters).
    Fixed bug #80077 (getmxrr test bug).
    Fixed bug #72941 (Modifying bucket-&gt;data by-ref has no effect any longer).
    Fixed bug #80067 (Omitting the port in bindto setting errors).
  Version 7.4.10
  03 Sep 2020
    Core:
    Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
    Fixed bug #77932 (File extensions are case-sensitive).
    Fixed bug #79806 (realpath() erroneously resolves link to link).
    Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
    Fixed bug #79919 (Stack use-after-scope in define()).
    Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
    Fixed bug #79947 (Memory leak on invalid offset type in compound assignment).
    COM:
    Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
    Exif:
    Fixed bug #75785 (Many errors from exif_read_data).
    Gettext:
    Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
    LDAP:
    Fixed memory leaks.
    OPcache:
    Fixed bug #73060 (php failed with error after temp folder cleaned up).
    Fixed bug #79917 (File cache segfault with a static variable in inherited method).
    PDO:
    Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
    Session:
    Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
    Standard:
    Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
    Fixed bug #79944 (getmxrr always returns true on Alpine linux).
    Fixed bug #79951 (Memory leak in str_replace of empty string).
    XML:
    Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).
  Version 7.4.9
  06 Aug 2020
    Apache:
    Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
    COM:
    Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
    Fixed bug #63527 (DCOM does not work with Username, Password parameter).
    Core:
    Fixed bug #79740 (serialize() and unserialize() methods can not be called statically).
    Fixed bug #79783 (Segfault in php_str_replace_common).
    Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
    Fixed bug #79779 (Assertion failure when assigning property of string offset by reference).
    Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
    Fixed bug #78598 (Changing array during undef index RW error segfaults).
    Fixed bug #79784 (Use after free if changing array during undef var during array write fetch).
    Fixed bug #79793 (Use after free if string used in undefined index warning is changed).
    Fixed bug #79862 (Public non-static property in child should take priority over private static).
    Fixed bug #79877 (getimagesize function silently truncates after a null byte) (cmb)
    Fileinfo:
    Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
    FTP:
    Fixed bug #55857 (ftp_size on large files).
    Mbstring:
    Fixed bug #79787 (mb_strimwidth does not trim string).
    Phar:
    Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
    Reflection:
    Fixed bug #79487 (::getStaticProperties() ignores property modifications).
    Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
    Fixed bug #79820 (Use after free when type duplicated into ReflectionProperty gets resolved).
    Standard:
    Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
    Fixed bug #78008 (dns_check_record() always return true on Alpine).
    Fixed bug #79839 (array_walk() does not respect property types).
  Version 7.4.8
  09 Jul 2020
    Core:
    Fixed bug #79595 (zend_init_fpu() alters FPU precision).
    Fixed bug #79650 (php-win.exe 100% cpu lockup).
    Fixed bug #79668 (get_defined_functions(true) may miss functions).
    Fixed bug #79683 (Fake reflection scope affects __toString()).
    Fixed possibly unsupported timercmp() usage.
    Exif:
    Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
    Fileinfo:
    Fixed bug #79681 (mime_content_type/finfo returning incorrect mimetype).
    Filter:
    Fixed bug #73527 (Invalid memory access in php_filter_strip).
    GD:
    Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
    OpenSSL:
    Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
    PDO SQLite:
    Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
    phpdbg:
    Fixed bug #73926 (phpdbg will not accept input on restart execution).
    Fixed bug #73927 (phpdbg fails with windows error prompt at "watch array").
    Fixed several mostly Windows related phpdbg bugs.
    SPL:
    Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
    Standard:
    Fixed bug #74267 (segfault with streams and invalid data).
  Version 7.4.7
  11 Jun 2020
    Core:
    Fixed bug #79599 (coredump in set_error_handler).
    Fixed bug #79566 (Private SHM is not private on Windows).
    Fixed bug #79489 (.user.ini does not inherit).
    Fixed bug #79600 (Regression in 7.4.6 when yielding an array based generator).
    Fixed bug #79657 ("yield from" hangs when invalid value encountered).
    FFI:
    Fixed bug #79571 (FFI: var_dumping unions may segfault).
    GD:
    Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
    MySQLnd:
    Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
    Opcache:
    Fixed bug #79588 (Boolean opcache settings ignore on/off values).
    Fixed bug #79548 (Preloading segfault with inherited method using static variable).
    Fixed bug #79603 (RTD collision with opcache).
    Standard:
    Fixed bug #79561 (dns_get_record() fails with DNS_ALL).
- fixes [bsc#1203867] and [bsc#1203870]
- modified patches
  % php-no-build-date.patch (refreshed)
  % php7-arm-build-fixes.patch (refreshed)
- deleted patches
  - php-fix_net-snmp_disable_MD5.patch (upstreamed)
  - php-odbc-cmp-int-cast.patch (not needed,
    dropped from factory as well, see
    last comment of
    https://bugs.php.net/bug.php?id=52554)
  - php7-CVE-2017-8923.patch (upstreamed)
  - php7-CVE-2020-7068.patch (upstreamed)
  - php7-CVE-2020-7069.patch (upstreamed)
  - php7-CVE-2020-7070.patch (upstreamed)
  - php7-CVE-2020-7071.patch (upstreamed)
  - php7-CVE-2021-21702.patch (upstreamed)
  - php7-CVE-2021-21703.patch (upstreamed)
  - php7-CVE-2021-21704.patch (upstreamed)
  - php7-CVE-2021-21705.patch (upstreamed)
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
</package>
<package pkgid="0e1eadeaa80c7790d47ee7f9b904557827bbb8e75fa22701f6bb172af71617b5" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.33" rel="150200.3.46.2"/>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __?allStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
  Version 7.4.25
  21 Oct 2021
    DOM:
    Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
    FFI:
    Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).
    Fileinfo:
    Fixed bug #78987 (High memory usage during encoding detection).
    Filter:
    Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
    FPM:
    Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
    SPL:
    Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
    Streams:
    Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
    XML:
    Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
    Zip:
    Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
    Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).
  Version 7.4.24
  23 Sep 2021
    Core:
    Fixed bug #81302 (Stream position after stream filter removed).
    Fixed bug #81346 (Non-seekable streams don't update position after write).
    Fixed bug #73122 (Integer Overflow when concatenating strings). (CVE-2017-8923)
    GD:
    Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).
    Opcache:
    Fixed bug #81353 (segfault with preloading and statically bound closure).
    Shmop:
    Fixed bug #81407 (shmop_open won't attach and causes php to crash).
    Standard:
    Fixed bug #71542 (disk_total_space does not work with relative paths).
    Fixed bug #81400 (Unterminated string in dns_get_record() results).
    SysVMsg:
    Fixed bug #78819 (Heap Overflow in msg_send).
    XML:
    Fixed bug #81351 (xml_parse may fail, but has no error code).
    Zip:
    Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
  Version 7.4.23
  26 Aug 2021
    Core:
    Fixed bug #72595 (php_output_handler_append illegal write access).
    Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).
    Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).
    BCMath:
    Fixed bug #78238 (BCMath returns "-0").
    CGI:
    Fixed bug #80849 (HTTP Status header truncation).
    GD:
    Fixed bug #51498 (imagefilledellipse does not work for large circles).
    MySQLi:
    Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).
    OpenSSL:
    Fixed bug #81327 (Error build openssl extension on php 7.4.22).
    PDO_ODBC:
    Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).
    Phar:
    Fixed bug #81211: Symlinks are followed when creating PHAR archive.(cmb)
    Shmop:
    Fixed bug #81283 (shmop can't read beyond 2147483647 bytes).
    Standard:
    Fixed bug #72146 (Integer overflow on substr_replace).
    Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
    Fixed bug #74960 (Heap buffer overflow via str_repeat).
    Streams:
    Fixed bug #81294 (Segfault when removing a filter).
  Version 7.4.22
  29 Jul 2021
    Core:
    Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
    Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
    Fixed bug #80728 (PHP built-in web server resets timeout when it can kill the process).
    Fixed bug #73630 (Built-in Webserver - overwrite $_SERVER['request_uri']).
    Fixed bug #80173 (Using return value of zend_assign_to_variable() is not safe).
    Fixed bug #73226 (--r[fcez] always return zero exit code).
    Intl:
    Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
    Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone).
    Fixed bug #74264 (grapheme_strrpos() broken for negative offsets).
    OpenSSL:
    Fixed bug #52093 (openssl_csr_sign truncates $serial).
    PCRE:
    Fixed bug #81101 (PCRE2 10.37 shows unexpected result).
    Fixed bug #81243 (Too much memory is allocated for preg_replace()).
    Standard:
    Fixed bug #81223 (flock() only locks first byte of file).
  Version 7.4.21
  01 Jul 2021
    Core:
    Fixed bug #81068 (Double free in realpath_cache_clean()).
    Fixed bug #76359 (open_basedir bypass through adding "..").
    Fixed bug #81090 (Typed property performance degradation with .= operator).
    Fixed bug #81070 (Integer underflow in memory limit comparison).
    Fixed bug #81122 (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
    Bzip2:
    Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).
    OpenSSL:
    Fixed bug #76694 (native Windows cert verification uses CN as server name).
    PDO_Firebird:
    Fixed bug #76448 (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
    Fixed bug #76449 (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
    Fixed bug #76450 (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
    Fixed bug #76452 (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
    Standard:
    Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
  Version 7.4.20
  03 Jun 2021
    Core:
    Fixed bug #80929 (Method name corruption related to repeated calls to call_user_func_array).
    Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
    Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
    Fixed bug #80972 (Memory exhaustion on invalid string offset).
    FPM:
    Fixed bug #65800 (Events port mechanism).
    FTP:
    Fixed bug #80901 (Info leak in ftp extension).
    Fixed bug #79100 (Wrong FTP error messages).
    GD:
    Fixed bug #81032 (GD install is affected by external libgd installation).
    MBString:
    Fixed bug #81011 (mb_convert_encoding removes references from arrays).
    ODBC:
    Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator).
    PDO_MySQL:
    Fixed bug #81037 (PDO discards error message text from prepared statement).
    PDO_ODBC:
    Fixed bug #44643 (bound parameters ignore explicit type definitions).
    pgsql:
    Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
    SPL:
    Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
    Opcache:
    Fixed bug #80900 (switch statement behavior inside function).
    Fixed bug #81015 (Opcache optimization assumes wrong part of ternary operator in if-condition).
    XMLReader:
    Fixed bug #73246 (XMLReader: encoding length not checked).
    Zip:
    Fixed bug #80863 (ZipArchive::extractTo() ignores references).
  Version 7.4.19
  06 May 2021
    PDO_pgsql:
    Reverted bug fix for #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
  Version 7.4.18
  29 Apr 2021
    Core:
    Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
    Fixed bug #75776 (Flushing streams with compression filter is broken).
    Dba:
    Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN).
    DOM:
    Fixed bug #66783 (UAF when appending DOMDocument to element).
    FPM:
    Fixed bug #80024 (Duplication of info about inherited socket after pool removing).
    FTP:
    Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open).
    Imap:
    Fixed bug #80710 (imap_mail_compose() header injection).
    Intl:
    Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
    LibXML:
    Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers).
    Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8).
    MySQLnd:
    Fixed bug #80713 (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
    Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an error).
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    Opcache:
    Fixed bug #80805 (create simple class and get error in opcache.so).
    Fixed bug #80950 (Variables become null in if statements).
    Pcntl:
    Fixed bug #79812 (Potential integer overflow in pcntl_exec()).
    PCRE:
    Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
    PDO_ODBC:
    Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
    PDO_pgsql:
    Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
    phpdbg:
    Fixed bug #80757 (Exit code is 0 when could not open file).
    Session:
    Fixed bug #80774 (session_name() problem with backslash).
    Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
    SOAP:
    Fixed bug #69668 (SOAP special XML characters in namespace URIs not encoded).
    Standard:
    Fixed bug #78719 (http wrapper silently ignores long Location headers).
    Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI).
    Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
    Fixed bug #80915 (Taking a reference to $_SERVER hides its values from phpinfo()).
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.16
  04 Mar 2021
    Core:
    Fixed bug #80706 (mail(): Headers after Bcc headers may be ignored).
    MySQLnd:
    Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
    MySQLi:
    Fixed bug #74779 (x() and y() truncating floats to integers).
    OPcache:
    Fixed bug #80682 (opcache doesn't honour pcre.jit option).
    OpenSSL:
    Fixed bug #80747 (Providing RSA key size &lt; 512 generates key that crash PHP).
    Phar:
    Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
    Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
    Fixed bug #53467 (Phar cannot compress large archives).
    SPL:
    Fixed bug #80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
    Standard:
    Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
    Zip:
    Fixed bug #80648 (Fix for bug 79296 should be based on runtime version).
  Version 7.4.15
  04 Feb 2021
    Core:
    Fixed bug #80523 (bogus parse error on &gt;4GB source code).
    Fixed bug #80384 (filter buffers entire read until file closed).
    Curl:
    Fixed bug #80595 (Resetting POSTFIELDS to empty array breaks request).
    Date:
    Fixed bug #80376 (last day of the month causes runway cpu usage.
    MySQLi:
    Fixed bug #67983 (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
    Fixed bug #64638 (Fetching resultsets from stored procedure with cursor fails).
    Fixed bug #72862 (segfault using prepared statements on stored procedures that use a cursor).
    Fixed bug #77935 (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
    Phar:
    Fixed bug #77565 (Incorrect locator detection in ZIP-based phars).
    Fixed bug #69279 (Compressed ZIP Phar extractTo() creates garbage files).
    SOAP:
    Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702)
  Version 7.4.14
  07 Jan 2021
    Core:
    Fixed bug #74558 (Can't rebind closure returned by Closure::fromCallable()).
    Fixed bug #80345 (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
    Fixed bug #72964 (White space not unfolded for CC/Bcc headers).
    Fixed bug #80362 (Running dtrace scripts can cause php to crash).
    Fixed bug #80393 (Build of PHP extension fails due to configuration gap with libtool).
    Fixed bug #80402 (configure filtering out -lpthread).
    Fixed bug #77069 (stream filter loses final block of data).
    Fileinfo:
    Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT).
    FPM:
    Fixed bug #69625 (FPM returns 200 status on request without SCRIPT_FILENAME env).
    Intl:
    Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined).
    OpenSSL:
    Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
    Phar:
    Fixed bug #73809 (Phar Zip parse crash - mmap fail).
    Fixed bug #75102 (`PharData` says invalid checksum for valid tar).
    Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
    PDO MySQL:
    Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
    Fixed bug #63185 (nextRowset() ignores MySQL errors with native prepared statements).
    Fixed bug #78152 (PDO::exec() - Bad error handling with multiple commands).
    Fixed bug #70066 (Unexpected "Cannot execute queries while other unbuffered queries").
    Fixed bug #71145 (Multiple statements in init command triggers unbuffered query error).
    Fixed bug #76815 (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
    Standard:
    Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
    Fixed bug #80366 (Return Value of zend_fstat() not Checked).
    Fixed bug #80411 (References to null-serialized object break serialize()).
    Tidy:
    Fixed bug #77594 (ob_tidyhandler is never reset).
    Zlib:
    Fixed bug #48725 (Support for flushing in zlib stream).
  Version 7.4.13
  26 Nov 2020
    Core:
    Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
    Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
    COM:
    Fixed bug #62474 (com_event_sink crashes on certain arguments).
    DOM:
    Fixed bug #80268 (loadHTML() truncates at NUL bytes).
    FFI:
    Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
    IMAP:
    Fixed bug #64076 (imap_sort() does not return FALSE on failure).
    Fixed bug #76618 (segfault on imap_reopen).
    Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
    Fixed minor regression caused by fixing bug #80220.
    Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
    MySQLi:
    Fixed bug #79375 (mysqli_store_result does not report error from lock wait timeout).
    Fixed bug #76525 (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
    Fixed bug #72413 (mysqlnd segfault (fetch_row second parameter typemismatch)).
    ODBC:
    Fixed bug #44618 (Fetching may rely on uninitialized data).
    Opcache:
    Fixed bug #79643 (PHP with Opcache crashes when a file with specific name is included).
    Fixed run-time binding of preloaded dynamically declared function.
    OpenSSL:
    Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
    PDO MySQL:
    Fixed bug #66528 (No PDOException or errorCode if database becomes unavailable before PDO::commit).
    Fixed bug #65825 (PDOStatement::fetch() does not throw exception on broken server connection).
    SNMP:
    Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
    Standard:
    Fixed bug #80266 (parse_url silently drops port number 0).
  Version 7.4.12
  29 Oct 2020
    Core:
    Fixed bug #80061 (Copying large files may have suboptimal performance).
    Fixed bug #79423 (copy command is limited to size of file it can copy).
    Fixed bug #80126 (Covariant return types failing compilation).
    Fixed bug #80186 (Segfault when iterating over FFI object).
    Calendar:
    Fixed bug #80185 (jdtounix() fails after 2037).
    IMAP:
    Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
    Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
    Fixed bug #80220 (imap_mail_compose() may leak memory).
    Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
    Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
    Fixed bug #80226 (imap_sort() leaks sortpgm memory).
    MySQLnd:
    Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
    Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
    ODBC:
    Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
    Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
    Fixed bug #80150 (Failure to fetch error message).
    Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
    Fixed bug #46050 (odbc_next_result corrupts prepared resource).
    OPcache:
    Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
    Fixed bug #80194 (Assertion failure during block assembly of unreachable free with leading nop).
    PCRE:
    Updated to PCRE 10.35.
    Fixed bug #80118 (Erroneous whitespace match with JIT only).
    PDO_ODBC:
    Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
    Standard:
    Fixed bug #80114 (parse_url does not accept URLs with port 0).
    Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
    Fixed bug #76735 (Incorrect message in fopen on invalid mode).
    Tidy:
    Fixed bug #77040 (tidyNode::isHtml() is completely broken).
  Version 7.4.11
  01 Oct 2020
    Core:
    Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
    Fixed bug #79979 (passing value to by-ref param via CUFA crashes).
    Fixed bug #80037 (Typed property must not be accessed before initialization when __get() declared).
    Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
    Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
    Calendar:
    Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
    COM:
    Fixed bug #64130 (COM obj parameters passed by reference are not updated).
    OPcache:
    Fixed bug #80002 (calc free space for new interned string is wrong).
    Fixed bug #80046 (FREE for SWITCH_STRING optimized away).
    Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
    OpenSSL:
    Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
    PDO:
    Fixed bug #80027 (Terrible performance using $query-&gt;fetch on queries with many bind parameters).
    SOAP:
    Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
    Standard:
    Fixed bug #79986 (str_ireplace bug with diacritics characters).
    Fixed bug #80077 (getmxrr test bug).
    Fixed bug #72941 (Modifying bucket-&gt;data by-ref has no effect any longer).
    Fixed bug #80067 (Omitting the port in bindto setting errors).
  Version 7.4.10
  03 Sep 2020
    Core:
    Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
    Fixed bug #77932 (File extensions are case-sensitive).
    Fixed bug #79806 (realpath() erroneously resolves link to link).
    Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
    Fixed bug #79919 (Stack use-after-scope in define()).
    Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
    Fixed bug #79947 (Memory leak on invalid offset type in compound assignment).
    COM:
    Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
    Exif:
    Fixed bug #75785 (Many errors from exif_read_data).
    Gettext:
    Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
    LDAP:
    Fixed memory leaks.
    OPcache:
    Fixed bug #73060 (php failed with error after temp folder cleaned up).
    Fixed bug #79917 (File cache segfault with a static variable in inherited method).
    PDO:
    Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
    Session:
    Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
    Standard:
    Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
    Fixed bug #79944 (getmxrr always returns true on Alpine linux).
    Fixed bug #79951 (Memory leak in str_replace of empty string).
    XML:
    Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).
  Version 7.4.9
  06 Aug 2020
    Apache:
    Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
    COM:
    Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
    Fixed bug #63527 (DCOM does not work with Username, Password parameter).
    Core:
    Fixed bug #79740 (serialize() and unserialize() methods can not be called statically).
    Fixed bug #79783 (Segfault in php_str_replace_common).
    Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
    Fixed bug #79779 (Assertion failure when assigning property of string offset by reference).
    Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
    Fixed bug #78598 (Changing array during undef index RW error segfaults).
    Fixed bug #79784 (Use after free if changing array during undef var during array write fetch).
    Fixed bug #79793 (Use after free if string used in undefined index warning is changed).
    Fixed bug #79862 (Public non-static property in child should take priority over private static).
    Fixed bug #79877 (getimagesize function silently truncates after a null byte) (cmb)
    Fileinfo:
    Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
    FTP:
    Fixed bug #55857 (ftp_size on large files).
    Mbstring:
    Fixed bug #79787 (mb_strimwidth does not trim string).
    Phar:
    Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
    Reflection:
    Fixed bug #79487 (::getStaticProperties() ignores property modifications).
    Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
    Fixed bug #79820 (Use after free when type duplicated into ReflectionProperty gets resolved).
    Standard:
    Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
    Fixed bug #78008 (dns_check_record() always return true on Alpine).
    Fixed bug #79839 (array_walk() does not respect property types).
  Version 7.4.8
  09 Jul 2020
    Core:
    Fixed bug #79595 (zend_init_fpu() alters FPU precision).
    Fixed bug #79650 (php-win.exe 100% cpu lockup).
    Fixed bug #79668 (get_defined_functions(true) may miss functions).
    Fixed bug #79683 (Fake reflection scope affects __toString()).
    Fixed possibly unsupported timercmp() usage.
    Exif:
    Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
    Fileinfo:
    Fixed bug #79681 (mime_content_type/finfo returning incorrect mimetype).
    Filter:
    Fixed bug #73527 (Invalid memory access in php_filter_strip).
    GD:
    Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
    OpenSSL:
    Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
    PDO SQLite:
    Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
    phpdbg:
    Fixed bug #73926 (phpdbg will not accept input on restart execution).
    Fixed bug #73927 (phpdbg fails with windows error prompt at "watch array").
    Fixed several mostly Windows related phpdbg bugs.
    SPL:
    Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
    Standard:
    Fixed bug #74267 (segfault with streams and invalid data).
  Version 7.4.7
  11 Jun 2020
    Core:
    Fixed bug #79599 (coredump in set_error_handler).
    Fixed bug #79566 (Private SHM is not private on Windows).
    Fixed bug #79489 (.user.ini does not inherit).
    Fixed bug #79600 (Regression in 7.4.6 when yielding an array based generator).
    Fixed bug #79657 ("yield from" hangs when invalid value encountered).
    FFI:
    Fixed bug #79571 (FFI: var_dumping unions may segfault).
    GD:
    Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
    MySQLnd:
    Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
    Opcache:
    Fixed bug #79588 (Boolean opcache settings ignore on/off values).
    Fixed bug #79548 (Preloading segfault with inherited method using static variable).
    Fixed bug #79603 (RTD collision with opcache).
    Standard:
    Fixed bug #79561 (dns_get_record() fails with DNS_ALL).
- fixes [bsc#1203867] and [bsc#1203870]
- modified patches
  % php-no-build-date.patch (refreshed)
  % php7-arm-build-fixes.patch (refreshed)
- deleted patches
  - php-fix_net-snmp_disable_MD5.patch (upstreamed)
  - php-odbc-cmp-int-cast.patch (not needed,
    dropped from factory as well, see
    last comment of
    https://bugs.php.net/bug.php?id=52554)
  - php7-CVE-2017-8923.patch (upstreamed)
  - php7-CVE-2020-7068.patch (upstreamed)
  - php7-CVE-2020-7069.patch (upstreamed)
  - php7-CVE-2020-7070.patch (upstreamed)
  - php7-CVE-2020-7071.patch (upstreamed)
  - php7-CVE-2021-21702.patch (upstreamed)
  - php7-CVE-2021-21703.patch (upstreamed)
  - php7-CVE-2021-21704.patch (upstreamed)
  - php7-CVE-2021-21705.patch (upstreamed)
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
</package>
<package pkgid="2a301ed8103309d1bfd037d38099a9fb88f919f6db3bbb6c094515ec9484537a" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="150200.3.38.2"/>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
</package>
<package pkgid="a2545130bae62a217860b4a5f359d48829a23cc77ea1d7512f38b3d33aa6435a" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="150200.3.38.2"/>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
</package>
<package pkgid="7218794e6c953a27314b8002f04f2ccc899c808d96ee14894ac54e87d0694cc5" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="150200.3.38.2"/>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
</package>
<package pkgid="3c28e4bf18b663b1e6a986d921ca23aa5ec4ec1aeba1181275fbfe55011682c0" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="150200.3.38.2"/>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
</package>
<package pkgid="9318ea67db20724ed37bf3d16d34eee168e5fe4f2740b13d1cd8a25bf88dbb13" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="150200.3.41.1"/>
  <changelog author="pgajdos@suse.com" date="1589284800">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
</package>
<package pkgid="a84e37f84494438702549a13332ffaaa1497c1b3756d0256cd56b0e568577f3d" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="150200.3.41.1"/>
  <changelog author="pgajdos@suse.com" date="1589284800">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
</package>
<package pkgid="0d82e00394be86fed93a5c1dc7584c1a871b8a472a6d40a76d9fd95578f3ef63" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="150200.3.41.1"/>
  <changelog author="pgajdos@suse.com" date="1589284800">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
</package>
<package pkgid="0029a1f89e39b83f6aac7d164503ac1f75ad4243a645f59425a8c9fe384f7045" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="150200.3.41.1"/>
  <changelog author="pgajdos@suse.com" date="1589284800">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726401">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
</package>
<package pkgid="cc065dcf10caddc472ae080d6115998da29bbc6ce77bfc5065b8316370f97527" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="0e646258c16751afd6479e6194255bb49a75e3ba2d9d039dc9983fbb5d99587d" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="164da94bb6bfc6b6f6e39112353e864317a9a992cfde574049b1a7d5deeec8cd" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="7e4807802123f9f3217150d238c3e52b73cbc3671507ea7592a234875da86328" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="a3b5dc23840bcef60ac5ff820ceca6774906b382aab23a3fab2f3c64afed5cbd" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="3.29.1"/>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
</package>
<package pkgid="1e56cc8970ac1b11f33a2346e28ad870c513ec18b08d5a9762c4a6aec06e8046" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="3.29.1"/>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
</package>
<package pkgid="487b7660f2061e7e4f17fab85e765f2347565b3d6ab5315c7e81b2a64b8928e3" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="3.29.1"/>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
</package>
<package pkgid="8bc110b9c1211cfa97a3024ab03db412318d2cd1cf391dfddd1d5cfe3b280f73" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="3.29.1"/>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
</package>
<package pkgid="67e4e4d3bc8be7836a90ec369718e4a75d332dc573a3bb7bab9341934b7db0b1" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
</package>
<package pkgid="6a66d6fdced97566dcaa2a949cacf5ee746eb092499a11d0c4eec7ce5eab3cd2" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
</package>
<package pkgid="71250a2868e40aa9ebc650d1502618d94dd99617247efa39b53364b4e326a8f9" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
</package>
<package pkgid="1f090a8e8b93cb2517dba875c8b8a33f1db2e0de6a9fc9957f5aa35c0f8531a6" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
</package>
<package pkgid="106fa4d2d9165682e64bdf78abf2871708e4d2076021466eac8c703deff50508" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="3.35.1"/>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
</package>
<package pkgid="055e1cff09559aae4869fae63b29ddb325f7ebee155fc5ecfdbf4ac45e4767b7" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="3.35.1"/>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
</package>
<package pkgid="2f9c0cdd4d79712daf9fdf3397aac92cc51fdb2f6aad291e111c5fd87cf97c71" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="3.35.1"/>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
</package>
<package pkgid="0161d15f598923055c91a0f5a7c94736e503b8a303bd619ab7248d461dab5ec7" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="3.35.1"/>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- added patches [bsc#1175508]
  fix https://github.com/php/php-src/pull/7428
  + php7-bsc1175508.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1635508800">- security update
- added patches
  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
  + php7-CVE-2021-21703.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637928000">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644840000">- security update
- added patches
  fix CVE-2017-8923 [bsc#1038980], denial of service (application crash) by using .= with a long string (zend_string_extend func in Zend/zend_string.h)
  + php7-CVE-2017-8923.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
</package>
<package pkgid="7549617f90022eddc59130a3133dad8e190671674549c3a61496bca5247c3736" name="apache2-mod_wsgi" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="5e5fba85fce295f8185c9156accf3294757dda5e2fc4176bac73a8a3823e0725" name="apache2-mod_wsgi" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="288e62798eac3b03ffb77f5b5cfe2e7d0d589771cf7846636acfeec94621d723" name="apache2-mod_wsgi" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="6b21631b4b9623ac2e45dcba26ffcbfda9cb550340ec21ef59507886af0547de" name="apache2-mod_wsgi" arch="src">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="46394cb2d0a1b6d47f4990e6640ea2fe33096cb22fcdddce446fbe57184cf5d1" name="apache2-mod_wsgi" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="5f1ee77aaefc9d73ecbe0f09de5a0d28b1b3a2007ffd803a44932efc537590a6" name="apache2-mod_wsgi" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="e9f65a9b8faba290d15877fe111e8a3dc436cd18d06f8b2eacf4afc4e7cec39d" name="apache2-mod_wsgi" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="4cf67342591ea9d31627bd5eaf42742ddbcdcd55f366cc9598e299b66c7b5962" name="apache2-mod_wsgi" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="257f4f74f125f7afa4df12ead6a6e322ecdb9779be2fab1c29ac8ba4009697d7" name="apache2-mod_wsgi" arch="src">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Update to version 3.4:
  + New support for Apache 2.4
  + Support for Python 3.2
  + Is now guaranteed that mod_ssl access handler is run before
    that for mod_wsgi so that any per request variables setup by
    mod_ssl are available in the mod_wsgi access handler as
    implemented by WSGIAccessScript directive.
  + Added 'python-home' option to WSGIDaemonProcess.
  + Added 'lang' and 'locale' options to WSGIDaemonProcess.
  + Split combined WWW-Authenticate header returned from daemon
    process back into separate headers.
- Introduce build compatibility with apache 2.4: apxs2 was moved
  from %{_sbindir} to %{_bindir}</changelog>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="26592c1d26001c2d1786aebbfd427e4e9de7e0c2e190248b2719598248a0f8ae" name="apache2-mod_wsgi" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="1da09fa66fdc8839385ac50683bd3dd3fefb51ebb683a26459a88ac2539e3f3d" name="apache2-mod_wsgi-python3" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="b795b00ae6f9971030850091739e660f937689d5ee5302267a94af4dae152074" name="apache2-mod_wsgi-python3" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="be085228f32f7c39b7ac365bfa3b1871b55cf7e1f138937559b4d3c2cfc4f26e" name="apache2-mod_wsgi-python3" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="da6c42adf8a3e22ea342fa523836185064d403313b7e8fdb5cc80b515e18edec" name="apache2-mod_wsgi-python3" arch="src">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="f426334352f13c93b39068217187b1a28290054d6b600891d7b768769f952811" name="apache2-mod_wsgi-python3" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="150000.4.6.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
  <changelog author="mmachova@suse.com" date="1664193600">- Add CVE-2022-2255.patch (bsc#1201634)</changelog>
</package>
<package pkgid="2b7940dc8fc6cbf6444f1da414e5c2de68d156dcd9f12ceb2b8e88b42ab5b7a1" name="apache2-mod_wsgi-python3" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="fb1f3a091362300c74e45ee9a0819b0f0211bae8f941ff79cce9321b9d549996" name="apache2-mod_wsgi-python3" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="261812754dbd8f7ee76a0710cf44f6b2949a8a7c6bde1ed0a7514410134e78d5" name="apache2-mod_wsgi-python3" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="09d06567b1ce8cc42b7eb2da60686db00ca0f06ab76c4d98b2f787c9c67472e4" name="apache2-mod_wsgi-python3" arch="src">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Update to version 3.4:
  + New support for Apache 2.4
  + Support for Python 3.2
  + Is now guaranteed that mod_ssl access handler is run before
    that for mod_wsgi so that any per request variables setup by
    mod_ssl are available in the mod_wsgi access handler as
    implemented by WSGIAccessScript directive.
  + Added 'python-home' option to WSGIDaemonProcess.
  + Added 'lang' and 'locale' options to WSGIDaemonProcess.
  + Split combined WWW-Authenticate header returned from daemon
    process back into separate headers.
- Introduce build compatibility with apache 2.4: apxs2 was moved
  from %{_sbindir} to %{_bindir}</changelog>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="96ef0445f69688d1d53dfcc22b62974c4931f59dc3c11ea52e6c57c8c62748c0" name="apache2-mod_wsgi-python3" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="5dad1aa4af76c08dbfad0ccbb346b1fccca100d4f112180492f54d92e9c89739" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="e8d81ac6860e28708acba360d4ba47dad23c861aa2514c764ef86430a7b93217" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="5ef5e6173de6b1955965e77b9b468b37768773f0c777d85249626e81693f14f4" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="f929b98446098d49d884747b018f30fba087d3102d320e37701a940efa25512d" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="6aa31d83fd909e6aa4fd023469b358eb4897949ac47652e93141206926d5ea46" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="8a7597808dd8c20d25515ec00f7acda5b1dd05e1b30471ea75cf8d379596c142" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="5672f296e8d5cf500cb65d9ca873e8ba432f219f7b1443ce1d9283c94571b280" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="e6f551d3e5c9c7d899cd84e79b4d2c10c388537ffe7ed4f87db6bcbf9109babc" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ae7d37a64e3cdaee517bf21a75ca10362c4c3bd6bccbbb27e9f1c8c08f37c3c1" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="ca1e3914c68f4607316a80db23b6070885556ca98b70a727d8e1143471781848" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="7295deba97e3b8fcb9adaa9bd45e8d0ea2d6eb46cf586cf51eb9c16e97f66219" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="d9aa4d2e85dff1e481569f0fe656cbcf8dc45dfae782b5efabfaf7ee45ebf35d" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="3c95493b8039f89c41a3e7dbf9cac8da48b6c3e4b2f86935fe1c1d39bc289b27" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="c1126f62c842d2b1cc43f036eb74d95aae74fa25af860badad4e366d363327bc" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="a52505d57554a7b0554c670e87c595513608ddb8ccfab58d9c3c5a618b2e8458" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="2a30a6e006a9337b9e5ad390fe1412974fe70df893aef8f4d911bffe0e501c6e" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="916e9e4ae689ea3f905f908eb5cff58b51fc0134f308805187a3c931e770e0df" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0f374dc8b6ae7692850ec1d138928f720fbe1afdb4cbcd2e3abf10e19d09eac5" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="6f26dee789f34360d25c82dddb99e6c2412da97dfe42f82aeca08234a213c4da" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="1ea50ac846131d4a554d46d34c3541a3a3a10a723bdb190c238042bea04ae9b3" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="34ee44986ff4819ab971d40113d72530315e563b04782da970e73993553e6a45" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="7614cda74d41c4dab3b63c0c617eec192a4a152e0747124a18f731fb0d535fd2" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="c349b97efdc93bf8dd2ae7f9941ed33fd421a352606013ee8d113588661e80b4" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="0204847bca849fe359b29651194281062daa00bd1d07a53e9c1f2d30c01b24af" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="f76ce3f962699bcf1d74946188799745ea3ff5300b3b47d08822a718b45397b0" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="8b3189a46ef7d43d46b02bd465604fbdc44cfd0ea78181eeedece35fa0b241ca" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="ae33390f27d21806b054259982e0cbffe79b51a8aed76d7d30b9935705da2b1b" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="612f9a7513a058beb9c56dadc1adf3de30c0e8e00a21b84c3fd0539165094a34" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="da4b67b409ff629366fc27c9998d603c3b64e6679dbdc960cdd23ce576b58124" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="42e725f139389230db0f0dd2863288b6bb62fa2736804509b41623dc61a8696f" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="5742bd3e5bb0fc629d79fd1ddc431d9e4100b5e3c6aa1232bdc1adb2b21937b9" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="66a67f133f3813bfbb762da1404856bedc36f13a3821c3ca386e0be01841a5a4" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="fff80f836c7869366b14c0175f3b8edb4f81d6ffb564b2570f191317e82a1eaa" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="63fe7b257c100f1c5547afa0ed45c504e0c7df3c34c33691065cac879a4f21bd" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="c29f8eff53e00a7450b2bf1f01e447f867b7dd310e64bf493b3c502637a649f9" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="57a467eb08865a1a6df903edb273efc7c798bc93bb2b9dde5a732d43e78c02a6" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="87dad0ea8a57e5ddf34cda536e1194e18dddc438418c846574af6ad7864bac34" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="81a501f2d1e4b51c41c4b7b0431c2bd37b90a9e029198658a28100d5509cef3a" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="3c13628920aa4232912f371b37b7f8cb11a9fbb51e2e0916cdb5b65b090be3ff" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="5b041ac4d3d279dbe6dab084a4b5eeb89441d731fda5cbe71dc68127ce36c6de" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="046f486ce71290dc3edc532a5c248ff16c82b8bb8aea7563ed37d948f978f642" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="f976a6df7b742eadb53e3c1054695c6880950c2515d88af35fc4576d1f291e28" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="48cca2d17c5b8a0593a2c15ff37f75eac9391b30f5d870a4878e98cab61839fe" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0994069f417614de1c1444438a9cefde43ca2591cf8e7660ccf8cee246363bb3" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="ce81f057a2e203ec82fe22527485fbc7cb1aacdacc68b41cca8ca7c09f531582" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="07c2a6bacb83929080646713b7b34a79e18a94ad025b2ed587d81803f97e85ce" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="5bd09fa63a60940f63fa3cf4346b4f1d63f5a70360d12cee7b68ae777dc30111" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="e89da58fd76cb220e818b71be0a5030a534f1e7d3e8cbf297a97c9338984ce3b" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="75b8106896cdeab92cefe14cbc4dd6ec2b298bc6148d183455b0f2a3bb14fc28" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="bd4da34da187980a5b2bb6628fee119c2d6fa2fee54268918bc27478729b71aa" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="5e2e80c69634a68551ca949c1127e9260619ac992a02cfc842f44488478a2026" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="bb526fe2c16f8f7dfe1dd9538817e86d426e276284fd4b1d2cce6a0e4a04ceec" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="72fb2e5be2e8c6b5929475699b9f61368448a3f2ada470e6c56e7ff45cf983d7" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="480428980f94efcb0c30da89e9999383eb2720cbcd8a7a37df326d7646af2776" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="abb863db089a93ecae5bf7e727dfc3b147771e06b97396a83e831195cb995be7" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="39ee082f1d5c692f3de594f5c18d115111a1bc7d86651c9ef8c46f1809b2da50" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="debce18dd58f747371cb36c335097cf15961563bddecf85ce89317b5f847818b" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="93f3fd81f066bd67bb320a68c2f64ebb2961bf1c51794d615297c7db8d0ed5f4" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="01e191c292afa45978ba04fa81d8f6036b86824c2d8f14d1ca4ce0aa5c8f6d2e" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="797ec49b212690406e40def8f0701d077502ef3b0ddf46f528a86b74cb21a164" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="735bacdf9e698bde359b82b923905a225fb181b467621cc4ff6952c3aca645d5" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ad591f48d9b2014457ff882940cd91305562e4ed66c543ee3dec51b717ae375a" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="f35f1d75eef34b1649677e8d23272efb29dc9da4afa53f6d2c39a4cf601791ea" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="5adda4cf2ac2313b5b58048cd74dabbcdc78072ff0d18b23d26f4e2aec41628e" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="47b8fbd6b5afe9557ec461e82909f606dc50a774951496b737792ee067605621" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="2a133c9943e8baf123e9410daafe29ae97ecb869a29ef73b7cd6d149cea8570c" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="b8f8c7036df8e43f19a5dda2472dbb12dca4f19b3cc8ffe8511065edc43d1756" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="8543b531ae96da6c5d7b245039ba0e07f87fcca0e85ccd4d67b7fba2471f2fcd" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="984a33361b46d68db75a1d9f4d145aa7af67a883b98cee82273d0a0fefe406c7" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="1ee82162843e840a8f31bde2db7b9249a75ec7a48597567a88ec221a12ee972e" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="e2ba1e35d0e2016c781c711e9751dc7b7da27bb5189c54cb462c66d4871db1d1" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="0fd24d355f6042b1d8f1c502e7cf0334e3676a3e886db6c5a6376dd865ee812c" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.42.1"/>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="3470aa92ceebf0bb99365accee6bdfa4c1638cdf11dd0af95fc985991395e3bf" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="4f0f6a299cf7f6e8b09b905ac4fafc1fb42693551c04a38b3cde6a335443dcce" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="fa76b825170ffce4c4fa53a815d012319e90ec6e658fe667be1bc9b8c58374d1" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="df1c2f993d169d5f8dc9449c12302f9aaa81e277e07ccc9604efb14f05e267b8" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.45.1"/>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
</package>
<package pkgid="4bf8dc5be25ece6510f89669df1d0529312e4ca0c4b0ea5a477568d2a1493c52" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="eb78f92c0f87267f56c82a60973f5e4d2c681582323da1bc4ccf66c6783e26ed" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="c78b342a1e572c826b8c1c2c431467858a0a33bbc2e056aacb0c81b321e0c085" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="93cdef27fc64f2a5bd0f2a2af130754fe103605b77ed66f9391a13355cec4770" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="150200.3.48.1"/>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610107200">- mod_php8 provides php_module [bsc#1195130]
- modified sources
  % apache2-script-helpers</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
  <changelog author="david.anes@suse.com" date="1647432000">- security update
- added patches
  fix CVE-2022-23943 [bsc#1197098], heap out-of-bounds write in mod_sed
  + apache2-CVE-2022-23943.patch
  fix CVE-2022-22720 [bsc#1197095], HTTP request smuggling due to incorrect error handling
  + apache2-CVE-2022-22720.patch
  fix CVE-2022-22719 [bsc#1197091], use of uninitialized value of in r:parsebody in mod_lua
  + apache2-CVE-2022-22719.patch
  fix CVE-2022-22721 [bsc#1197096], possible buffer overflow with very large or unlimited LimitXMLRequestBody
  + apache2-CVE-2022-22721.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1647518400">- security update
- modified patches
  % apache2-CVE-2022-23943.patch (refreshed)</changelog>
  <changelog author="david.anes@suse.com" date="1654862400">- security update
- added patches:
  fix CVE-2022-26377 [bsc#1200338], possible request smuggling in mod_proxy_ajp
  + apache2-CVE-2022-26377.patch
  fix CVE-2022-28614 [bsc#1200340], read beyond bounds via ap_rwrite()
  + apache2-CVE-2022-28614.patch
  fix CVE-2022-28615 [bsc#1200341], read beyond bounds in ap_strcmp_match()
  + apache2-CVE-2022-28615.patch
  fix CVE-2022-29404 [bsc#1200345], denial of service in mod_lua r:parsebody
  + apache2-CVE-2022-29404.patch
  fix CVE-2022-30556 [bsc#1200350], information disclosure in mod_lua with websockets
  + apache2-CVE-2022-30556.patch
  fix CVE-2022-30522 [bsc#1200352], mod_sed denial of service
  + apache2-CVE-2022-30522.patch
  fix CVE-2022-31813 [bsc#1200348], mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
  + apache2-CVE-2022-31813.patch</changelog>
</package>
<package pkgid="da01290c0343447f06e89c049f02175226f0d96eb52cf0d4187a2f5dfc094f71" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="03588438c0f890fad8e65e56479f0b5c772213a0503c40d2b17e3abcb9c7e27a" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="af1012b3a0e2cda0608331d333edcc7fc0b0f2710c594ba13a5b34913fa4d608" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="baec68a9bab03e185ab1a4a277f6f68fa2b1fdbe5a0ee6f05490b77ade29d380" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.51" rel="3.37.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1637236800">- version update to 2.4.51: fixes also
  CVE-2020-11984 [bsc#1175074] -- mod_proxy_uwsgi info disclosure and possible RCE
  CVE-2020-13950 [bsc#1187040] -- mod_proxy NULL pointer dereference
  CVE-2020-35452 [bsc#1186922] -- Single zero byte stack overflow in mod_auth_digest
  CVE-2021-26690 [bsc#1186923] -- mod_session NULL pointer dereference in parser
  CVE-2021-26691 [bsc#1187017] -- Heap overflow in mod_session
  CVE-2021-30641 [bsc#1187174] -- MergeSlashes regression
  CVE-2021-31618 [bsc#1186924] -- NULL pointer dereference on specially crafted HTTP/2 request
  CVE-2021-33193 [bsc#1189387] -- Request splitting via HTTP/2 method injection and mod_proxy
  CVE-2021-34798 [bsc#1190669] -- NULL pointer dereference via malformed requests
  CVE-2021-36160 [bsc#1190702] -- out-of-bounds read via a crafted request uri-path
  CVE-2021-39275 [bsc#1190666] -- out-of-bounds write in ap_escape_quotes() via malicious input
  CVE-2021-40438 [bsc#1190703] -- SSRF via a crafted request uri-path
  CVE-2020-11993 [bsc#1175070] -- when trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection
  CVE-2020-9490 [bsc#1175071] -- specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash
- modified patches
  % httpd-2.4.x-fate317766-config-control-two-protocol-options.diff (refreshed)
- deleted patches
  - apache2-CVE-2020-11984.patch (upstreamed)
  - apache2-CVE-2020-13950.patch (upstreamed)
  - apache2-CVE-2020-35452.patch (upstreamed)
  - apache2-CVE-2021-26690.patch (upstreamed)
  - apache2-CVE-2021-26691.patch (upstreamed)
  - apache2-CVE-2021-30641.patch (upstreamed)
  - apache2-CVE-2021-31618.patch (upstreamed)
  - apache2-CVE-2021-33193.patch (upstreamed)
  - apache2-CVE-2021-34798.patch (upstreamed)
  - apache2-CVE-2021-36160.patch (upstreamed)
  - apache2-CVE-2021-39275.patch (upstreamed)
  - apache2-CVE-2021-40438.patch (upstreamed)
  - apache2-mod_http2-1.15.14.patch (upstreamed)
  - apache2-mod_proxy_uwsgi-fix-crash.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1640174400">- security update
- added patches
  fix CVE-2021-44224 [bsc#1193943], NULL dereference or SSRF in forward proxy configurations
  + apache2-CVE-2021-44224.patch
  fix CVE-2021-44790 [bsc#1193942], buffer overflow when parsing multipart content in mod_lua
  + apache2-CVE-2021-44790.patch</changelog>
</package>
<package pkgid="906bf74ba26a6f9da29518bae069505fc9a714667a7e642898b13d07457be5f1" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="62179929170ee1c83bdce4c7c0e10d016526dc8034784e47bb969096cadc32c2" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="4f6d22b7ca932c597b562d3762e666d48e89e4c291f3de3ced3e0e9338f7fbdc" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="62050ef79e5c39bb9d90052a95ec835c7396561346775dafb30a83a49ba38d4f" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="55145b1abb0ed5258d4074daa6d642ab1438555be577d93def7b2f5321492df2" name="apparmor-abstractions" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="4874c87884d96a38ea6fcdf7bc867f8077efdb809d6ccac8bcf6e71d449acb6a" name="apparmor-abstractions" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="b8457769125ed17f4141007adba2f0d14774e428e2d6159f426f9a3195440319" name="apparmor-abstractions" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="d7abcae82aa288b2a060fa638886392bfcc993ef0453f426a94f897800eeb6c6" name="apparmor-abstractions" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="09b0bb935683dd146340c393d5d180a973764036110157f7f0632a440e64fe4e" name="apparmor-docs" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="c81487387bec2bfa1493e7a547675faa6bd95d3664d5abaa80899dac57325386" name="apparmor-docs" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="d95c3233b7660eea26d30c4ae055a72b823fb21854651b7df20a721ebe58f82d" name="apparmor-docs" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="f8b0500786c451f893ee6f85ac7828771779c6336f5745c0c5b92656fee88ffd" name="apparmor-docs" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="2f92653b7c79f049b5da8b3f97b27c28e4755940ee968b66f22e2cc1b6e69949" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="f74b520fcfa56d1c26f256eff0c6819c7da79b33f2906f8b2637af5ff8b9f533" name="apparmor-parser" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="4bbcaf6708f618e71f4c7c0cc88de91597a6585b5e5af8eae54aad5424db5c65" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="08588839386e56795bf2a628992b4dbc43102821ede1e4b9e061afbfe8e00d22" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="739ba6f7c3a7ab330ee1592a71023ae80e92c272586620f2f014dfc895c5c402" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="7f3172f2c5d6532cfb9dd5996f99bec97914a87aa96b33ad98d10a6d7259908a" name="apparmor-parser" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="3a81fbacaaabf0371be6505b9efe58668773178bea99bac26e4e91f3ac251557" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="00aadc46dfa2a1a94297a1e1cf56c3c05bb978a73619e9e8640ea3aa579bf282" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="d73df644b715d5904df8eaf2e5826fae914c0426ed402c63e218b9a6601e4256" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="a5f0681eceef585ce974a3531bade29dd084f9096551512d09049692198eff0f" name="apparmor-parser" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="af62dd0eadc4e761ce7fca4ed27aa2b1954b5a815d84c590010f04381aaf048a" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="386f995c8f88b602cbabdd8b23c1006c54d4f43b6161e209bbcecde1098213dc" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="5fed4469b69306d70aa3485ff303ef1bfa38e97294d16e2ad08c99cf8f45464f" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="35e4195fd13b267baab569fd85f72b36c91916bc052fdeaeca7570cbb851e378" name="apparmor-parser" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="2701dfa3cbf4b3d56b807e017c5f637f87a6668961e90fbe383ebca66ec36879" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="279c6e492f6b84caffdf5a2b2c224ffb965d9d44618fad369725f2e06d3361f1" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="1a7dc99dd14d4a583c65799b8a049a1079d12fbb02cb53ac746cbb018b621bc4" name="apparmor-parser-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="2f36a933c445d7e82b595935051ff604dce0bee479fbfeccc1d759708506cd00" name="apparmor-parser-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="dedca84eddf75c1610aa138dc7787e56f0ba2888c9786da72ad3c802144be0be" name="apparmor-parser-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="39ba04f8247e08945996f4d648bac8af7a2fa915776c3152ebec0919be20bfb5" name="apparmor-parser-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="738f126169802d946ed75db18954a2f93ee387d4f2a8c4aeec7da88584712768" name="apparmor-profiles" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="b5dda1f54c15a0502d8b24670790cdd0a79caab734d6a082360b1bee39c60c71" name="apparmor-profiles" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="1ae108ede9fba5ab1c008e105bd82a9e1f19f66799fa05be050ab38ce5c6c750" name="apparmor-profiles" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="b952c3fa8a92deabe8fba7fdb9fcca258297c0c3e5903c32788876c6255553a8" name="apparmor-profiles" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="f5378ac14fe43d08e3cf22d563417f6ee5bf0dd22610bfb55caa7af632e24d51" name="apparmor-utils" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="66ab0d876aa11a312241e51db7109e5d8505fcd5b7904c99a9dd861e62c120e8" name="apparmor-utils" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="70efd6120f2d6d02445421d939d8fe764a16537fb7fcd36103fad2cf76fec8d8" name="apparmor-utils" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="88dd75d5335681b94b174e4bf07a53f335427e6ab28e446107b3068a77534523" name="apparmor-utils" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="8ed5a3618ef8e749b8c1e5df7b7f2ad4679f6c1363b2536f0ef0bccd0cd04436" name="apparmor-utils-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.11.2"/>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
</package>
<package pkgid="07788d77f8c535344eee518d9056d8a38f637eda7c1a190e8b2b0fb5b3dcfcf6" name="apparmor-utils-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="e63d991ed10608b077ae4961c91ca3a3920b317eb24fb3c36822018920935ca8" name="apparmor-utils-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="d3f670a3a92e25959f866911da0281677eb7d4f064bce7f1e443892787e4ba64" name="apparmor-utils-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.8.1"/>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
</package>
<package pkgid="8fcd37c81392aac74760165e826cc9c0453e140edb1160681ba61bae8cc8a7bd" name="apr-util" arch="src">
  <version epoch="0" ver="1.6.1" rel="18.2.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1377691200">- Use compiler symbol visibility
- libapr1 does not have symbol *versioning* so requires_ge it</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1385035200">- version 1.5.3
  * Add support to apr_memcache for unix domain sockets.
  * Add support for Berkeley DB 6.0.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1410955200">- version 1.5.4
  * MySQL driver: Fix incorrect handling of bad parameter.
  * apr_crypto_get_driver(): Fix invalid storage reference on error path.
- docs: Tell doxygen not to store timestamps in files.</changelog>
  <changelog author="tchvatal@suse.com" date="1413460800">- Clean up with spec-cleaner
- Kill support of sle10 and sle9
- Remove unused configure switches</changelog>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1599048000">- separate dbm_db into own package [jsc#SLE-12211]
- build dbm_gdbm connector
- added patches
  fix https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602676800">- devel package has to require gdbm-devel [jsc#SLE-12211]</changelog>
</package>
<package pkgid="2b7755111078f0e2af476c2352c85e945f2aa795347d66d5ba8f7037735d5c03" name="apr-util-devel" arch="aarch64">
  <version epoch="0" ver="1.6.1" rel="18.2.1"/>
  <changelog author="tchvatal@suse.com" date="1413460800">- Clean up with spec-cleaner
- Kill support of sle10 and sle9
- Remove unused configure switches</changelog>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1599048000">- separate dbm_db into own package [jsc#SLE-12211]
- build dbm_gdbm connector
- added patches
  fix https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602676800">- devel package has to require gdbm-devel [jsc#SLE-12211]</changelog>
</package>
<package pkgid="a345b403bcef71bb441d8c9892c4db9c12b31e3641d87aa2c87844bac2a1bd9d" name="apr-util-devel" arch="ppc64le">
  <version epoch="0" ver="1.6.1" rel="18.2.1"/>
  <changelog author="tchvatal@suse.com" date="1413460800">- Clean up with spec-cleaner
- Kill support of sle10 and sle9
- Remove unused configure switches</changelog>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1599048000">- separate dbm_db into own package [jsc#SLE-12211]
- build dbm_gdbm connector
- added patches
  fix https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602676800">- devel package has to require gdbm-devel [jsc#SLE-12211]</changelog>
</package>
<package pkgid="7ea7a5069ef41f5b5c62b40a876ba114b5609abff790ed14bdfed15ed6e5eb82" name="apr-util-devel" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="18.2.1"/>
  <changelog author="tchvatal@suse.com" date="1413460800">- Clean up with spec-cleaner
- Kill support of sle10 and sle9
- Remove unused configure switches</changelog>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1599048000">- separate dbm_db into own package [jsc#SLE-12211]
- build dbm_gdbm connector
- added patches
  fix https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602676800">- devel package has to require gdbm-devel [jsc#SLE-12211]</changelog>
</package>
<package pkgid="147fc9bcd35ec59ae037d59fbe035f23b2a24d56a26325538f35b469ea5b7590" name="apr-util-devel" arch="x86_64">
  <version epoch="0" ver="1.6.1" rel="18.2.1"/>
  <changelog author="tchvatal@suse.com" date="1413460800">- Clean up with spec-cleaner
- Kill support of sle10 and sle9
- Remove unused configure switches</changelog>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1599048000">- separate dbm_db into own package [jsc#SLE-12211]
- build dbm_gdbm connector
- added patches
  fix https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602676800">- devel package has to require gdbm-devel [jsc#SLE-12211]</changelog>
</package>
<package pkgid="b6749203a601266e07099beb96ff175e1c357175fc7e8ac75075683c78a40d2b" name="argyllcms" arch="aarch64">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="cd34dbef65b066573af736003229704686ec0d6a0f8684b854e338dbe99e2ddd" name="argyllcms" arch="ppc64le">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="3da05e2be68de2cfbb0928b603317e392238509c76beffb26082f5dc7240c2c9" name="argyllcms" arch="s390x">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="b6b73edfbe183ae3281a93faeb749e176973e7eaaba1c0118f867714daca41bf" name="argyllcms" arch="src">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1326974400">- remove unused copies of libusb0 and libusbw
- remove unused code from libusb1 directory (windows / macos)
- call autoreconf in %build</changelog>
  <changelog author="kkaempf@suse.com" date="1327320000">- ColorHug-sensor-driver.patch: Fix function declaration to improve
  detection of 'perfect black' (via colorhug-users@googlegroups.com)</changelog>
  <changelog author="mcihar@suse.cz" date="1327665600">- Fix ColorHug support with new firmware</changelog>
  <changelog author="fcrozat@suse.com" date="1340625600">- Release 1.4.0:
  + various bug fixes
  + add support for ICC profiles in embedded JPEG
  + fix CVE-2012-1616 (bnc#768322)
- drop autotools patches, switch back to original Jam based build
- add ajam (argyll patched version of Jam, BSD-license) to source
  package (needed only for build)
- drop shared libraries and corresponding subpackages, not used by
  anything.
- drop cologhug patch, merged upstream.
- Add argyllcms-fixbuild.patch: fix build with system tiff/jpeg
  libraries
- Add ajam-include.patch: add missing headers
- Add argyllcms-1.4.0-warnings.patch: fix gcc warnings
- Add bison as BuildRequires (needed to build ajam)
- Compile with -f-no-strict-aliasing to prevent potential issues
  with gcc 4.7</changelog>
  <changelog author="fcrozat@suse.com" date="1340712000">- Add new upstream version of SG_header.txt, to prevent any legal
  misunderstanding (bnc#768826).</changelog>
  <changelog author="coolo@suse.com" date="1350043200">- replace jam with ./jam</changelog>
  <changelog author="fcrozat@suse.com" date="1350561600">- Fix build with new udev rules directory location.</changelog>
  <changelog author="fcrozat@suse.com" date="1375272000">- Release 1.5.1:
  + Many bug fixes
  + add support for i1pro Rev E (i1pro2)
  + improved support for ColorMunki and i1pro
  + spotread can interactively query refresh rate
  + spyd2en, spyd4en and i1d3ccss was been merged in one tool named
    oeminst.
  + No longer uses libusb, talk directly to USB device through
    kernel devices.
  + Add support for ColorCheckerPassport in scanin.
  + -V (adaptative mode) is deprecated in dispcal, dispread and
    ccxxmake, since it is the default. Use -ZA flag to disable.
  + ColorHug support is enabled by default.
  + Added automatic adjustement of patch reading for i1d3.
- Drop argyllcms-fixbuild.patch (merged)
- Rename argyllcms-1.3.0-udev151.patch to argyllcms-udev151.patch.
- Add argyllcms-udev-builtin.patch for udev usb-db builtin
  (openSUSE 12.2/12.3) and argyllcms-udev-hwdb.patch (openSUSE 13.1
  and later) for udev hwdb.
- Update argyllcms-1.4.0-warnings.patch (partially merged)
- Drop SG_header.txt, merged upstream.</changelog>
  <changelog author="sbrabec@suse.cz" date="1377000000">- Release 1.6.0:
  + Added support for JETI specbos 1211 and 1201.
  + Added Video profiling &amp; 3dLut creation support for eeColor and
    MadVR.
  + Linux profile installation will use colord.
  + Fix ColorHug driver.
  + Changed instlib API ambient XYZ and spectral units to Lux.
  + For those instruments that support it, made ambient readings
    honor refresh mode measurements.
  + Changed spotread -ew mode to be Bradford chromatic transform
    rather than XYZ scaling.
  + Added support to xicclu to lookup colors though CAL files.
  + Added -Y R:rate option to spotread, dispcal, dispread &amp;
    ccxxmake.
  + By default printtarg will create PS and EPS files with a CUPS
    job ticket to disable color management.
  + Added display update delay calibration support to i1pro and
    ColorMunki.
  + Changed dispcal &amp; dispread so that they wait up to 0.5 seconds
    when reading dark patches after light ones to allow for display
    fall time.
  + Changed dispwin daemon loader mode option from -E to -X.
  + Changed dispcal verify option from -E to -z.
  + Added -E option to to dispread to encode test patch colors in
    Video 16-235 range.
  + Changed CIECAM02 Flare model to distinguish between Flare from
    the image itself, and Glare from ambient light.
  + Improved i1pro hi-res mode to improve accuracy.
  + Added Body Centered Cubic grid option to targen.
  + Added -Yn flag to dispcal and dispread.
  + Improve robustness of i1d3 display update measurement code.
  + Added support for applying calibration curves in collink.
  + Changed spotread so that it won't fall back to emissive spot
    mode if an ambient reading is requested.
  + Turned off B2A table clip map smoothing.
  + Fixed crash in ucmm/ucmm.c when loading certain profiles using
    dispwin.
  + Fixed gamut mapping intent "rl" to really use relative L*a*b*
  + Fix bug in cicam02 in V1.5.0 that causes some mapping problems
    in the red for collink -ir or -ila.
  + Changed cctiff so that it does lossless JPEG copy when there is
    no color transformation
  + Fix xicclu so that it works with device links.
  + Fixed bug in shaper/matrix profile curves that caused random
    bumpy black behaviour.
  + Don't add colorant tag to .tiff files in cctiff unless it is a
    non-standard space, as Photoshop will barf on such files.
  + Fix bug with Spyder not being able to break out of dispcal
    adjustment loop.
  + Fix bug in xicc/xicclu, -K flag not being recognised.
  + Fix bug in xicc/xmatrix.c introduced that prevents matrix only
    profiles from being created.
  + libusb 1.0 is now deprecated in favor of native USB drivers.</changelog>
  <changelog author="fcrozat@suse.com" date="1387540800">- Release 1.6.2:
  + Added "dark region emphasis" -V parameter to targen and colprof.
  + Fixed bug and tweaked dispcal black point optimization to err on
  the black side. Added -v3 for even more debugging information.
  + Changed i1d3 driver to be more forgiving of EEProm checksum
  calculation (support for ""A-02"" release).
  + Fixed problem with TV encoded output and dispread -E -k/-K.
  + Fixed minor bug in DE94 in icclib.
  + Fixed major bug in illumread - result was being corrupted.
  + Fixed "edges don't match" bug in printarg when -iCM -h -s/-S
  used.
  + Fix bug in -H flag in ccxxmake, chartread, dispcal, dispread,
  illumread &amp; spotread so that it works once again.
- Bugfix update from 1.6.1:
  + Fix bug in "average -m"
  + Fix oeminst to work with a wider range of i1d3 install files.
  + Fix ColorMunki reflective measurement accuracy, particularly for
  reflective readings.
- Remove argyllcms-stringcompare.patch, argyllcms-void.patch:
  merged upstream.</changelog>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="3a08c9c1552de23e1c635b138bf5671cb48a02abb0763993244abb6611c0be4c" name="argyllcms" arch="x86_64">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="5c9e203a02ab9e597111c689c887a778afcf561d383fd020df3ed5a954629c6c" name="argyllcms-doc" arch="aarch64">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="acdd0395b06d5d01591c345935773d2ff2338b313ee219405c70961b5711ba25" name="argyllcms-doc" arch="ppc64le">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="50485d6f87a8a0db1e1328949f1e4b26fa71b65b5fba85abf7498010fddd4cbc" name="argyllcms-doc" arch="s390x">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="06271e0bb323e22471ba16467ae428c9b026c9942eb0df070a4489d563d5689f" name="argyllcms-doc" arch="x86_64">
  <version epoch="0" ver="1.9.2" rel="4.2.1"/>
  <changelog author="fcrozat@suse.com" date="1391169600">- Release 1.6.3:
  + Added ProPhoto.icm and ProPhotoLin.icm to ref profiles.
  + Fix bug in xicclu -py conversion.
  + Added code to minimize ICC rounding error on matrix profile
    white point accuracy. Re-generated all reference profiles with
    this change.
  + Changed i1d3 driver to completely ignore any EEPROM checksum
    errors for non "A-01" rev. instruments.
  + Made transplot handle RGB-&gt;RGB device link.
  + Removed colprof -y option. Use "profcheck -v2" instead, as it
    is more developed.
  + Fixed bug in dispcal - it was not using the final measurement
    pass to update the calibration curves.
  + Fixed bug in spotread, dispcal &amp; dispread for CCSS capable
    instruments where refresh display types was being ignored if a
    custom observer was used, and/or the custom observer as being
    ignored, and/or a  CCMX was being ignored.
  + Renamed verify to colverify to avoid clash with MSWin program
    of the same name. Made it print the patch location for -v2 if
    it is present in the file.
  + Changed targen to ensure that -V and -p options effects are
    reflected in the resulting expected CIE values of the .ti1
    file.
  + Changed targen so that -V parameter also affects single
    channel, grey wedge, grid &amp; body centered grid point
    distribution.
  + Changed colprof to deal with variable grid distribution in a
    more neuanced way, to reduce overshoot artifacts when the -V
    parameter is used.
  + Changed colprof to used a power_like function for the grid
    distribution shape from the -V parameter, so as to avoid issues
    with a power curve infinte slope near zero.
  + Changed colprof to used a scaled down value of the targen -V
    parameter as the default for its -V parameter.
  + Added a special case to collink for RGB video input encoding to
    (attempt) to fine tune the black point to compensate for it
    (probably) not falling on a cLUT grid point. &amp; out encoding.
  + Tweaked dispcal to try and improve accuracy of black point
    calibration.
  + Switch dispread to use NoClamp readings, so that average black
    point value is not biased.
  + Fixed bug introduced into 1.6.2 oeminst that prevents .ccss
    files being installed.</changelog>
  <changelog author="fcrozat@suse.com" date="1422273600">- Move reference files to /usr/share/argyll/ref, expected path from
  gnome-color-manager (bsc#914679).</changelog>
  <changelog author="fcrozat@suse.com" date="1423051200">- Add argyllcms.changes to Source, used to compute timestamp
- Use a stable timestamp for generated files (boo#916158), ensuring
  build is reproducible.</changelog>
  <changelog author="meissner@suse.com" date="1424692800">- do not rpm -q udev</changelog>
  <changelog author="meissner@suse.com" date="1424692801">- allow building with udev-mini by using pkgconfig(udev)</changelog>
  <changelog author="rguenther@suse.com" date="1424779200">- Use -std=gnu89 for building to not run into broken __declspec
  uses with the GCC 5 default of -std=gnu99.</changelog>
  <changelog author="p.drouand@gmail.com" date="1448366400">- Update to version 1.8.3
  * Added SpyderCheckr24 scaning .cht and .cie files.
  * Fixed USB problem with i1pro (Rev B &amp; D ?), where communications
    would occasionally break down on fast systems.
  * Added another fixed display intergration time to i1pro non-adaptive
    emission mode to cope with higher brightness displays.
  * Added workaround for i1d3 Rev. B status code 0x83 on very low
    light measurement
  * Fixed minor bug in i1d3.c that truncated serial number string.
  * Fixed bug in Klein K10 driver - adaptive measurement wasn't properly
    using all the extra measurements.
  * Improved Klein K10 driver to be more robust when lights off command
    returns bogus error codes, or causes a cascade of bogus measurement
    errors.
  * Added workaround for OS X 10.9+ "App Nap" problem.
  * Added maximum sensor frequency check for Spyder &amp; i1d3 drivers,
    so that erronious readings due to excessive brightness can't be missed.
  * Changed chartread so that it doesn't warn of a possible wrong strip
    being read, nor allows bi-directional strip reading, if "printtarg -r"
    was used. A warning will be issued if "printtarg -r" was used, and
    "chartread -B" wasn't used.
  * Fixed collink for eeColor Full range RGB to use output curve
    ("second" 1D curves) to compensate for cLUT being wired for 1.0
    output from 1.0 input.
  * Added "lp" gamut mapping intent :- Luminance Preserving Perceptual,
    for Photographers concerned with maintaining tonal variations.
  * Fixed bugs in image specific gamut mapping that were degrading
    the accuracy of the result.
  * Re-wrote gamut smoothing code, and re-tuned it to behave similarly
    to the V1.8.2 release.
  * Changed default viewing condition glare to 5%, to smooth out shadow tone curve.
  * Reduced the level of Helmholtz-Kohlrausch effect in CIECAM02
    implementation in the light of visual experiments.
- Changes from version 1.8.2
  * Fixed endless loop bug in alternate calibration selectors code.
- Changes from version 1.8.1
  * Fixed bug in "spec2cie -n" wrong field indexes were being used.
  * Fixed colorimeter calibration selectors to add in alternate
    selectors if the letters are free.
- Changes from version 1.8.0
  * Added support for the Image Engineering EX1 spectroradiometer.
  * Added support for the SwatchMate Cube reflective colorimeter,
    with improved accuracy.
  * Added Added Television Lighting Consistency Index (EBU TLCI-2012 Qa)
    to spotread and specplot output.
  * Added R9 value to CRI value in spotread and specplot output.
  * Added workaround for JETI specbos having been calibrated by
    a 3rd party, and its calibrated range being out of sync with
    its claimed range.
  * Added support for "EMISINPUT" type .ti3 file.
  * Build using OpenSSL rather than axTLS if it is built on Linux.
  * Fixed stack space problem in OS X UI programs by expanding main
    thread proxy to have 8MB instead of the default 512K.
  * Updated built in libtiff to V4.0.4beta.
  * Changed CGATS format to not emit unknown keyword declaration ("KEYWORD")
    by default.
  * Added inst_calc_cond_mask to inst.h to allow for flags in calibration
    conditions. A consequence of this is that calc needs to be masked with
    this when comparing against a specific condition, and the inst_calc_optional_flag
    should be cleared if it is set, before callint inst-&gt;calibrate() if the
    user wants to proceed with a particular calibration.
  * Fixed bug with dispcal -e N
  * Fixed bug in xicclu -fg and -kp
  * Added dispcal -x x option to allow reading a chart and manually entering
    the XYZ values.
  * Fix spyder4 &amp; 5 bug where some display types were set as refresh
    when they shouldn't be.
  * Fix collink "Warning :- RGB black hack trigger more than once!"
    when -b is used with input video encoding (-e).
  * Changed colprof so that the default ICC description is the base
    filename rather than the whole file path.
  * Fix technology type and display type selector "uniqueification"
    bug  that shows up in "ccxxmake -??".
  * Add OEM field to ccmx and ccss files to mark files that have
    been installed from OEM disk, so that custom ccmx &amp; ccss files
    can be given suggested selector letter priority (+ ref/CRT.ccss).
  * Tweak CGATS write format to avoid scientific notation until the
    numbers are bigger and smaller (i.e until e6 and e-6 are needed).
- Changes from version 1.7.0
  * Improved gamut mapping to reduce unnecessary changes to less
    saturated colors  such as skin tones.
  * Add support for DataColor Spyder 5.
  * Add support for ColorHug2 colorimeter.
  * Add support for Klein K10-A colorimeter.
  * Added Google ChromeCast as a test patch generator for Video displays.
  * Added ls2ti3 tool to convert LightSpace .bcs files to .ti3.
  * Added IRIDAS .cube 3DLut format support to collink.
  * Add X3D and X3DOM support as an alternative to VRML, and make X3DOM
    the default.
  * Add better cross compatibility with non-Argyll ICC profiles using
    ArgyllCMS 'arts' tag to mark 'wtpt' Absolute Colorimetric chromaticity
    transform, as well as implement proper absolute colorimetric intent
    for Display profiles use the 'chad' tag. Note that the standard
    ICC profiles provided by ArgyllCMS in the ref directory (such as sRGB etc.)
    now include an 'arts' tag.
  * Ignore any patches that have zero values for creating Display profiles,
    unless they are for device zero.
  * Fix various instrument communications problems for JETI specbos,
    DTP20, DTP92 &amp; DTP94.
  * Fix gestaltSystemVersion warning on OS X 10.10.
  * Fix very major bug in illumread. It wasn't actually working at all
    since V1.4.0.
  * Added collink -I[gG][:p.p]:x.x options that allows an output offset
    gamma curve be targetted instead of BT1886.
  * Added dispcal and collink -b black point hack. This forces the input
    zero to map to the output zero for well behaved displays, reducing
    dependence on the instrument accuracy for a very dark black point.
  * Added preset list of display techologies to select from in ccxxmake.
  * Added a -P prune option to profcheck, that creates a .ti3 file pruned
    of any patches that have a delta E fit error greater than a threshold.
    This may be of use in eliminating bad reading values from a measurement set.
  * Added histogram plot option -h to both profcheck and verify.
  * Added a dispread &amp; fakeread -Z option to set the number of bits to
    quantize the test values to.
  * Fixed bug in targen - the -V dark emphasis wasn't being applied to OFPS
    generated points.
  * Make sure that if an instrument display reading is interrupted by a
    forced calibration, that the user is asked to place it back on the
    display before resuming the measurements.
- Remove obsolete patches
  * argyllcms-udev-builtin.patch
  * argyllcms-udev-hwdb.patch
- Some specfile cleanups and improvements
- Update argyllcms-udev151.patch</changelog>
  <changelog author="lnussel@suse.de" date="1460548800">- BuildRequire systemd-rpm-macros which defines _udevrulesdir for us</changelog>
  <changelog author="guoyunhebrave@gmail.com" date="1489492800">- Update to version 1.9.2 and update patches
  * Added CMYKOGB and CMYKRGB 7 channel ink preset, and made targen
    more flexible in matching pre-conditioning profiles to targen ink
    selection.
  * Fix oeminst for OS X save location.
  * Fix oeminst for OS X Spyder 4 CD calibration file location.
  * Improved robustness of ChromeCast discovery, and added some minimal
    diagnostics.
  * Improved robustness of targen ofps patch generation when using less
    well behaved pre-conditioning profiles.
  * Fixed oeminst so that it locates cdrom's in Linuxes latest mount
    point of /run/media/$USER/.
  * Fixed bug in i1pro2 driver, in which strip calibration would fail
    if instrument had been first calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER
    set, and then calibrated with ARGYLL_DISABLE_I1PRO2_DRIVER unset.
  * Added option to icclib to write Output profiles using 'chad' tag if
    the ARGYLL_CREATE_DISPLAY_PROFILE_WITH_CHAD environment variable is
    set. This is not recommended for normal use, but may assist
    compatibility with other systems.
  * Added JETI spectraval support, including Bluetooth access.
  * Added support for the Klein K10 connecting via a serial port.
  * Fixed bug in Colormunki Smile driver that causes crash on Ubuntu
    16.04.1 LTS.
  * Modified "lp" intent to greatly reduce eliminate Helmholtz-Kohlrausch
    appearance modelling.
  * Fixed problem with targen -g, in that the corresponding XYZ values
    had double the power applied, rather than none. This was causing
    problems with printtarg spacer colors.
  * Extensive re-write of colorimetric nearest clipping code in rspl/rev.c
    to restore precision that was lost in the speedups made in V1.0.0. The
    nnrev setup now takes a lot longer with   high resolution CMYK profiles
    though. This corrects a "green becoming too yellow" problem for mapping
    from ProPhoto space with some RGB devices.
  * Change dispwin to properly set X11 DirectColor and take account of
    TrueColor Colormap.  This fixes problem with NVidia linux driver 364.12
    exposing a VideoLUT depth that is different from the frame buffer depth.
  * Change icclib to automatically repair icmTextDescription strings that
    have an allocation that is longer than their size.
  * Added i1Pro Lamp Drift test and fix functions to spotread (-Y l|L options).
  * Change colprof so that -s -S will accept general compression percentage
    as an alternative to a source colorspace/image gamut.
  * Added optional conversion from native Gretag-MacBeth &amp; X-Rite reflective
    calibration standards to/from XRGA.
  * Changed OS X GUI support code so as not to switch to "interact with the
    Dock" mode until actual GUI element is to be displayed. This prevents
    batch commands with optional GUI elements from blocking normal GUI
    interactions.
  * Re-jigged OS X UI code to use the main thread to avoid window
    creation timing issues and a warning backtrace on OS X 10.11.
  * Added CMP_Digital_Target-7.cht
  * Fix spec2cie to cope with .ti3 files that are missing device values,
    so that it can process a wider range of input CIE reference files.
  * Changed implementation of ARGYLL_NOT_INTERACTIVE on MSWin to make
    it more reliable when operated progromatically.
  * Fixed chartread so that if you are reading patch by patch, the
    location strings can be arbitrary (i.e. they don't have to conform
    to an alpha/num strip/patch pattern.)
  * Added support for Sencore ColorPro V, IV &amp; III colorimeters
    (based on Sequel Chroma colorimeter.).
- Drop argyllcms-udev151.patch
- Drop argyllcms-1.4.0-warnings.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1512993600">- replace xorg-x11-devel by the needed individual libraries.</changelog>
</package>
<package pkgid="b3faf7848b4830522d71df5092fb303127afdb370834995baea9c6bc163a2cdd" name="arpwatch" arch="aarch64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8acd2954a946e4cca7e4a5ce00cfee555f9be79fcf6e6772637d404de4b43cbe" name="arpwatch" arch="ppc64le">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="895c3c9f5f5bc9b9b0c36e759c7ea8354735aa2fe67aa43c615a0c2d86009dd1" name="arpwatch" arch="s390x">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8be6b12d08320d3c0ff7f2bb521dcf997f97fc234e46e2b1be42846e3cdc2bcd" name="arpwatch" arch="src">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="meissner@suse.de" date="1113825600">- Use RPM_OPT_FLAGS.</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="lrupp@suse.de" date="1179144000">- update to 2.1a15
  + let the database files belong to the package
  + build parallel
  + use rpm macros for configure and make</changelog>
  <changelog author="prusnak@suse.cz" date="1185451200">- changed libpcap to libpcap-devel in BuildRequires</changelog>
  <changelog author="draht@suse.de" date="1226491200">- start script tuned for multiple interface support and independent
  databases. #149003</changelog>
  <changelog author="draht@suse.de" date="1226491201">- arpwatch-2.1a11-emailaddr.dif for flexibility in sender and
  recipient addresses on commandline.
- arpwatch-2.1a11-drop-privs.dif to run arpwatch as different user
- arpwatch-2.1a11-drop-privs-manpage.dif for the manpage</changelog>
  <changelog author="mseben@novell.com" date="1259323200">- added ARPDIR to build section in spec file, to fix error message
  in logs</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="draht@suse.de" date="1342612800">- arpwatch-2.1a11-drop-privs.dif: call initgroups() with pw-&gt;pw_gid,
  not NULL, to not have groupid 0 initialized. [bnc#764521]</changelog>
  <changelog author="p.drouand@gmail.com" date="1363262400">- Drop sysvinit support and add systemd support for opensuse &gt; 11.4</changelog>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="b345c507fd6b53a2a1b803a9c6f19c1064f349295395cc82c02da3c9a51ef41c" name="arpwatch" arch="x86_64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="a533b3094d32dd321f7dd02211db1622c8f1dcef2a50e3fb7136b23dca2327b0" name="arpwatch-ethercodes-build" arch="aarch64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="591d821e429b3f65759ca652ab99846944edacdc9d2504ea0cc30d919df71ce7" name="arpwatch-ethercodes-build" arch="ppc64le">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8cda9df16e693c7d98c252eebbd9de4ff4d9154bf657587537d314c298f91514" name="arpwatch-ethercodes-build" arch="s390x">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="345a168e80fbb2b7d832725268d22dba8294665a8b2fd10458a1da0d35ef8212" name="arpwatch-ethercodes-build" arch="x86_64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="24987b0b73219aabd742c6daa620c8c64c25c3a85c0dce8f9683877a1e1c4708" name="aspell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="e12989037a55dedf7c4ae9d199d32640f485d287eae968a4a77748438401b33b" name="aspell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="27965ad0d0cf7b0cbaad177236bfd53b89da5b4c7daf70c0e95e5e5683b2b7e0" name="aspell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="7af3bc840843ac153efc6e98b98165554e8f3aa066cb393003e3aa26ccdc41ec" name="aspell" arch="src">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="pgajdos@suse.cz" date="1248091200">- fixed invalid iterator [bnc#523345]</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1317556800">- update to version 0.60.6.1
  * Update to Automake 1.10.3.
  * Fix a bug which caused a race condition (leading to a likely crash)
    when two threads try to update the dictionary cache at the same
    time.
  * Make it very clear that compiling Aspell with NDEBUG is a bad idea
    (see `http://aspell.net/ndebug.html') by outputting a warning when
    building with NDEBUG defined.
  * Numerous other minor updates and bug fixes.
- Spec file updates:
  * Changes based on spec-cleaner run.
  * Changed License: to LGPL-2.1+.
  * Splitted the package according to the shared library packaging policy
    (added libaspell15 and libpspell15 sub-packages).
  * Added descriptions for the patches based on openSUSE guidelines.
  * Suggest also aspell-spell sub-package.
  * Added versioned Provides:/Obsoletes: for pspell and pspell-devel (rpmlint
    warning fix).
  * Removed libstdc++-devel from Requires: of aspell-devel (not needed).
  * Improved summaries and descriptions.
  * Clean up in %build, %install and %files sections.
  * Install the "spell" script provided by the package for compatibility
    reasons (added a aspell-spell sub-package containing this script and moved
    the Provides: entry for "spell" into this package).
  * Use %fdupes macro to fix rpmlint warning about duplicate files.
  * Use %install_info_delete in %preun instead of %postun section.
  * Add pspell-config.1 man page to the aspell-devel sub-package instead of
    aspell.
- Removed the following patches (fixed upstream):
  * aspell-iterator-after-erase.patch
  * aspell-make-static-filters.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1321963200">- add -ltinfo</changelog>
  <changelog author="jengelh@medozas.de" date="1327752000">- Remove redundant tags/sections per specfile guideline suggestions</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1330084800">- Build C++ code with -fvisibility-inlines-hidden
- Fix ncurses linkage.</changelog>
  <changelog author="pgajdos@suse.com" date="1349784000">- license FDL-1.1+ and LGPL-2.1 and HPND and BSD-Mark-Modifications</changelog>
  <changelog author="pgajdos@suse.com" date="1362052800">- fix build with new automake
  * automake-1.13.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1362398400">- license GFDL-1.1+ and LGPL-2.1 and HPND and BSD-Mark-Modifications</changelog>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="460a84ca1b59be5a143ee10d771b73841fe1191b42ec1a0e77c02502e730b9c9" name="aspell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="ee5008fed95de2d39a6aa5798c8fb791eb708d6a33c83b1a4c2821141c8acb8f" name="aspell-devel" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="4b22fac26e2c77790d4c30cea6324a44dcafb31fd1774465ef922216479acbe4" name="aspell-devel" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="f5044f0b00bc68bf47c1133b6c8201e49ed56d23e12233bd44455e9c88bcbe60" name="aspell-devel" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="60b4239e283ee37ded36856522e4f50401f54b0bac796790fad0d964a1bcb447" name="aspell-devel" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="23ab80e0044bb1d65912848b0c1eeacd5ccb03688efaf44a249145aa564b390f" name="aspell-ispell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="7a56520b7f65c42a4cf3576c3c1de7cbc5d992679de7f340062be1cf47e41630" name="aspell-ispell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="167de1aba92e45ec2345eb4ab0491e6f4f7211f47a8024ec32d70b4bd476b67f" name="aspell-ispell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="350238c2dfc49559ba2ab4915b3c1e4d9afe5e9431c4ce7e0f88aba27d3a1db5" name="aspell-ispell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="af17c4cade47588297cd05605e645ff6b2aa971d85380b4ec001ff8b6a7506a4" name="aspell-spell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="f0e14b94c6af53e4b7c9bb0e1f4190975d6a5441202e4db50956d9b372431df1" name="aspell-spell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="92e96c42bd1f19889dba39d724e6822cb2e7ef973d9e038c52e43a2732c6d5e9" name="aspell-spell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="e0abc79ec65bb8e35d03b0f64301fee5e8a9ff584179a47a5a1138b0e5aa6ece" name="aspell-spell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="8acecc75062313dea4b1bd3d30977166381ddcaac4278c23420a96645e502f17" name="atkmm1_6" arch="src">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="vuntz@opensuse.org" date="1285588800">- Update to version 2.22.0:
  + Just increased version to show that it's an API/ABI-stable
    release.</changelog>
  <changelog author="vuntz@opensuse.org" date="1291723200">- Update to version 2.22.1:
  + Distribute the GPL in the tarball, in addition to the LGPL,
    because the Windows build uses a GPL builder tool.</changelog>
  <changelog author="vuntz@opensuse.org" date="1294574400">- Update to version 2.22.2:
  + Install m4 files needed by recent versions of gtkmm when
    building from git.</changelog>
  <changelog author="fcrozat@novell.com" date="1300881600">- Update to version 2.22.4:
  + Avoid a tarball dependency on mm-common.
- Changes from version 2.22.3:
  + a tarball regeneration due to a changed m4 macro in mm-common.</changelog>
  <changelog author="dimstar@opensuse.org" date="1304164800">- Update to version 2.22.5:
  + bgo#645669: Install the m4 files even without
  - -enable-maintainer-mode, as with other modules.
- Use source services: download_url and set_version.</changelog>
  <changelog author="vuntz@opensuse.org" date="1310040000">- Stop using source service to download the tarball, as Factory
  will move away from this.</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add atkmm-devel to baselibs</changelog>
  <changelog author="vuntz@opensuse.org" date="1321358400">- Update to version 2.22.6:
  + Add #includes needed with the latest glibmm.</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="coolo@suse.com" date="1359720000">- update license to new format</changelog>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="2adfba174adc8f8d070783748f96a4d294f54e0bc05afc0561612eb3aacba7a2" name="atkmm1_6-devel" arch="aarch64">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="4a7542846618887b6797a392de5d25483a7295498a66b64f9930dd87891f711c" name="atkmm1_6-devel" arch="ppc64le">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="425325cfedf1d4fb2568c647ce844f6aad114804bca189c384b941b5bfaee4f0" name="atkmm1_6-devel" arch="s390x">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="5c7bcc772ad51e9c53318ac7f6bf917e28b3e5d94b132b78d9367eb988bd2ac0" name="atkmm1_6-devel" arch="x86_64">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="bed2bccdda6e7616453cdcadc8cb7f62ef41606757c1bcaf22afa48a78ea9219" name="atkmm1_6-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="10c6129b47f5df585b20878ebb623ef79f6a8f91be1383c1769b27292be71d89" name="atkmm1_6-doc" arch="noarch">
  <version epoch="0" ver="2.28.0" rel="150200.3.2.1"/>
  <changelog author="dimstar@opensuse.org" date="1367236800">- Update to version 2.22.7:
  + Remove the use of g_type_init() because it has been deprecated.</changelog>
  <changelog author="zaitor@opensuse.org" date="1437825600">- Update to version 2.23.2:
  + Use (and require) C++11.
- Changes from version 2.23.1:
  + Atk:
  - Document: Add get/set_attribute() and deprecate
    get_document() and get_document_type().
  - Component: Deprecate add/remove_focus_handler, get_size() and
    get_position().
  - Add Range.
  - Table:
    . Deprecate get_column/row_at_index().
    . Add a get_at() const version and deprecate get_index_at().
  - Text:
    . Deprecate get_text_before_offset(),
    get_text_after_offset().
    . Add get_string_at_offset(), deprecating other methods for
    it.
  - Value: Deprecate get_minimum/maximum_range() in favour or
    get_range().
  + Build: Update MSVC 2005, 2008 and 2010 Projects: Add "Install"
    Project.</changelog>
  <changelog author="zaitor@opensuse.org" date="1441368000">- Update to version 2.23.3:
  + Rebuilt with latest glibmm, whose gmmproc generates C++ move
    operations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1443614400">- Update to version 2.24.1:
  + Regenerate with the latest glibmm.
- Changes from version 2.24.0:
  + MSVC build fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1448884800">- Update to version 2.24.2:
  + Regenerate with the latest glibmm.</changelog>
  <changelog author="idonmez@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Rename to atkmm1_6: atkmm 2.25.x brings a new API/ABI to be used
  in GTK4 based applications.</changelog>
  <changelog author="jengelh@inai.de" date="1480939201">- rectify rpm groups</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543752000">- Update to version 2.28.0:
  + No changes, version bump only.
- Changes from version 2.24.3:
  + Fix silent builds.
  + Text: Plug memory leaks in get_text_vfunc() and
    get_selection_vfunc(). These vfuncs shall delete the returned
    character array after it has been copied to a Glib::ustring.
  + Replace the Visual Studio project files with MSVC NMake project
    files.</changelog>
</package>
<package pkgid="463e9b7943b7fa2af7c138d65c18c9efb337d90b4621ae959a4804f5b294c309" name="augeas" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="8ca50e3534cc67bf21388f9cb4957a58d89db46d459b02f7feb171256a70b34a" name="augeas" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="739b5d0e328c815e41237f9f09a44ccbfd0f096c3896471393dada3226f49099" name="augeas" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="cb6316b151109c299fa497be2a83949db276989cd0ea854316de05a0c9e7119d" name="augeas" arch="src">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1386676800">- Update to version 1.1.0
  - Handle files with special characters in their name, bug #343
  - Fix type error in composition ('f; g') of functions, bug #328
  - Improve detection of version script; make build work on Illumos with
    GBU ld (Igor Pashev)
  - augparse: add --trace option to print filenames of all modules being
    loaded
  - Various lens documentation improvements (Jasper Lievisse Adriaanse)
  - Lens changes/additions
  - ActiveMQ_*: new lens for ActiveMQ/JBoss A-MQ (Brian Harrington)
  - AptCacherNGSecurity: new lens for /etc/apt-cacher-ng/security.conf
    (Erik Anderson)
  - Automaster: accept spaces between options
  - BBHosts: support more flags and downtime feature (Mathieu Alorent)
  - Bootconf: new lens for OpenBSD's /etc/boot.conf (Jasper Adriaanse)
  - Desktop: Support dos eol
  - Dhclient: read /etc/dhclient.conf used in OpenBSD (Jasper Adriaanse)
  - Dovecot: New lens for dovecot configurations (Serge Smetana)
  - Fai_Diskconfig: Optimize some regexps
  - Fonts: exclude all README files (Jasper Adriaanse)
  - Inetd: support IPv6 addresses, bug #320
  - IniFile: Add lns_loose and lns_loose_multiline definitions
    Support smart quotes
    Warning: Smart quotes support means users should not add
    escaped double quotes themselves. Tests need to be fixed
    also.
    Use standard Util.comment_generic and Util.empty_generic
    Warning: Existing lens tests must be adapted to use standard
    comments and empty lines
    Allow spaces in entry_multiline* values
    Add entry_generic and entry_multiline_generic
    Add empty_generic and empty_noindent
    Let multiline values begin with a single newline
    Support dos eol
    Warning: Support for dos eol means existing lenses usually
    need to be adapted to exclude \r as well as \n.
  - IPRoute2: Support for iproute2 files (Davide Guerri)
  - JaaS: lens for the Java Authentication and Authorization Service
    (Simon Vocella)
  - JettyRealm: new lens for jetty-realm.properties (Brian Harrington)
  - JMXAccess, JMXPassword: new lenses for ActiveMQ's JMX files
    (Brian Harrington)
  - Krb5: Use standard comments and empty lines
    Support dos eol
    Improve performance
    Accept pkinit_anchors (Andrew Anderson)
  - Lightdm: Use standard comments and empty lines
  - LVM: New lens for LVM metadata (Gabriel)
  - Mdadm_conf: optimize some regexps
  - MongoDBServer: new lens (Brian Harrington)
  - Monit: also load /etc/monitrc (Jasper Adriaanse)
  - MySQL: Use standard comments and empty lines
    Support dos eol
  - NagiosCfg: handle Icinga and resources.cfg (Jasper Adriaanse)
  - Nrpe: accept any config option rather than predefined list (Gonzalo
    Servat); optimize some regexps
  - Ntpd: new lense for OpenNTPD config (Jasper Adriaanse)
  - Odbc: Use standard comments and empty lines
  - Openshift_*: new lenses for Openshift support (Brian Harrington)
  - Quote: allow multiple spaces in quote_spaces; improve docs
  - Passwd: allow period in user names in spec, bug #337; allow overrides
    in nisentry
  - PHP: Support smart quotes
    Use standard comments and empty lines
    Load /etc/php*/fpm/pool.d/*.conf (Enrico Stahn)
  - Postfix_master: allow [] in words, bug #345
  - Resolv: support 'lookup' and 'family' key words, bug #320
    (Jasper Adriaanse))
  - Rsyslog: support :omusrmsg: list of users in actions
  - RX: add CR to RX.space_in
  - Samba: Use standard comments and empty lines
    Support dos eol
  - Schroot: Support smart quotes
  - Services: support port ranges (Branan Purvine-Riley)
  - Shellvars: optimize some regexps; reinstate /etc/sysconfig/network,
    fixes bug #330, RHBZ#904222, RHBZ#920609; parse /etc/rc.conf.local
    from OpenBSD
  - Sip_Conf: New lens for sip.conf configurations (Rob Tucker)
  - Splunk: new lens (Tim Brigham)
  - Subversion: Support smart quotes
    Use standard comments and empty lines
    Use IniFile.entry_multiline_generic
    Use IniFile.empty_noindent
    Support dos eol
  - Sudoers: allow user aliases in specs
  - Sysctl: exclude README file
  - Systemd: Support smart quotes; allow backslashes in values
  - Xinetd: handle missing values in list, bug #307
  - Xorg: allow 'Screen' in Device section, bug #344
  - Yum: Support dos eol, optimize some regexps</changelog>
  <changelog author="meissner@suse.com" date="1386936000">- download url changed, also added keyring and .sig ring</changelog>
  <changelog author="mlatimer@suse.com" date="1399291200">- device_map lense: Find device.map in any dir beneath /boot (bnc#875086)
  augeas-device_map-grub2.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1399377600">- Add check phase, comment out as 2 test fails now.
- Clean up with spec-cleaner
- Version bump to 1.2.0:
  - API changes
  * Add aug_cp and the cp and copy commands
  * aug_to_xml now includes span information in the XML dump
  - General changes/additions
  * Fix documentation link in c_api NaturalDocs menu
  * Fix NaturalDocs documentation for various lenses
  * src/transform.c (filter_matches): wrap fnmatch to ensure that an incl
    pattern containing "//" matches file paths, RHBZ#1031084
  * Correct locations table for transform_save() (Tomas Hoger)
  * Corrections for CVE-2012-0786 tests (Tomas Hoger)
  * Fix umask handling when creating new files, RHBZ#1034261
  - Lens changes/additions
  * Access: support DOMAIN\user syntax for users and groups, bug #353
  * Authorized_Keys: Allow 'ssh-ed25519' as a valid authorized_key
    type (Jasper Lievisse Adriaanse)
  * Automounter: Handle hostnames with dashes in them, GH issue #27
  * Build: Add combinatorics group
  * Cyrus_Imapd: Create new entries without space before separator,
    RHBZ#1014974 (Dietmar Kling)
  * Desktop: Support square brackets in keys
  * Dhclient: Add dhclient.conf path for Debian/Ubuntu (Esteve Fernandez)
  * Dhcpd: Support conditionals, GH issue #34
    Support a wider variety of allow/deny statement, including
    booting and bootp (Yanis Guenane)
    Support a wider variety of DHCP allow/deny/ignore statements
    (Yanis Guenane)
  * Dovecot: Various enhancements and bug fixes (Michael Haslgrübler):
    add mailbox to block_names, fix for block_args in quotes,
    fix for block's brackets upon write,
    fixes broken tests for mailbox,
    fixes indention,
    test case for block_args with ",
    fixes broken indention
    Use Quote module
  * Exports: Permit colons for IPv6 client addresses, bug #366
  * Grub: Support the 'setkey' and 'lock' directives
    NFC fix whitespace errors
    Handle makeactive menu command, bug #340
    Add 'verbose' option, GH issue #73
  * Interfaces: Add in support for the source stanza in
    /etc/network/interfaces files
    Map bond-slaves and bridge-ports to arrays (incompatible
    change) (Kaarle Ritvanen)
    Add /etc/network/interfaces.d/* support
    Allow numeric characters in stanza options (Pascal Lalonde)
  * Koji: New lens to parse Koji configs (Pat Riehecky)
  * MongoDBServer: Accept quoted values (Tomas Klouda)
  * NagiosCfg: Do not try to parse /etc/nagios/nrpe.cfg anymore, GH issue #43
    /etc/nagios/nrpe.cfg is parsed by Nrpe (Yanis Guenane)
  * Nagiosobjects: Add support for optional spaces and indents
    and whole-line comments (Sean Millichamp)
  * OpenVPN: Support daemon, client-config-dir, route, and management
    directives (Freakin https://github.com/Freakin)
  * PHP: allow php-fpm syntax in keys, GH issue #35
  * Postfix_Main: Handle stray whitespace at end of multiline lines, bug #348
  * Postfix_virtual: allow '+' and '=' in email addresses (Tom Hendrikx)
  * Properties: support multiline starting with an empty string, GH issue #19
  * Samba: Permit asterisk in key name, bug #354
  * Shellvars: Read /etc/firewalld/firewalld.conf, bug #363
    Support all types of quoted strings in arrays, bug #357
    Exclude /etc/sysconfig/ip*tables.save files
  * Shellvars, Sysconfig: map "bare" export and unset lines to seq numbered
    nodes to handle multiple variables (incompatible change), RHBZ#1033795
  * Shellvars_list: Handle backtick variable assignments, bug #368
    Allow end-of-line comments, bug #342
  * Simplevars: Add /etc/selinux/semanage.conf
  * Slapd: use smart quotes for database entries; rename by/what to by/access;
    allow access to be absent as per official docs (incompatible change)
  * Sshd: Indent Match entries by 2 spaces by default
    Support Ciphers and KexAlgorithms groups, GH issue #69
    Let all special keys be case-insensitive
  * Sudoers: Permit underscores in group names, bug #370 (Matteo Cerutti)
    Allow uppercase characters in user names, bug #376
  * Sysconfig: Permit empty comments after comment lines, RHBZ#1043636
  * Sysconfig_Route: New lens for RedHat's route configs
  * Syslog: Accept UDP(@) and TCP(@@) protocol, bug #364 (Yanis Guenane)
  * Xymon_Alerting: New lens for Xymon alerting files (François Maillard)
  * Yum: Add yum-cron*.conf files (Pat Riehecky)
    Include only *.repo files from yum.repos.d (Andrew N Golovkov)
    Permit spaces after equals sign in list options, GH issue #45
    Split excludes as lists, bug #275</changelog>
  <changelog author="tchvatal@suse.com" date="1404216000">- Enable tests but "pass" them even with 2 failures.</changelog>
  <changelog author="tchvatal@suse.com" date="1404302400">- Change desc to describe the "tools" not just the library
  bnc#885495.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="2170440d2b2119f75c03d71d8d4a6d4a0253b6015ea3f3d5f0fffe67167e5b16" name="augeas" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="5fb08c16d8b6a1153367a10fa5137cfe613d5664a3c112556243dc5648ede62c" name="augeas" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="b6f7e83c95c477c6d4a787ebeafeb1727d600799ffb5ef7b1a4eb46ca41c3bea" name="augeas" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="ca22058becae0ec862ec8b773340ceac9e385c4e65af4d26bb0414c74d164b34" name="augeas" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="d66105deb6f63f91f0abb9ff2f70547ac03ba459855aa101b0b6a3a057a82811" name="augeas" arch="src">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1349870400">- license update: GPL-3.0+ and LGPL-2.1+
  semicolon is ambiguous</changelog>
  <changelog author="poelzleithner@b1-systems.de" date="1365336000">- update to 1.0.0
  - drop bnc-729491-recognize-suse-sysconfig-files.patch:
    upstream ShellVars lense now uses /etc/sysconfig/* include filter
  - drop patches, now upstream: augeas-pkgdeps.diff, augeas-stdio.h.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1386676800">- Update to version 1.1.0
  - Handle files with special characters in their name, bug #343
  - Fix type error in composition ('f; g') of functions, bug #328
  - Improve detection of version script; make build work on Illumos with
    GBU ld (Igor Pashev)
  - augparse: add --trace option to print filenames of all modules being
    loaded
  - Various lens documentation improvements (Jasper Lievisse Adriaanse)
  - Lens changes/additions
  - ActiveMQ_*: new lens for ActiveMQ/JBoss A-MQ (Brian Harrington)
  - AptCacherNGSecurity: new lens for /etc/apt-cacher-ng/security.conf
    (Erik Anderson)
  - Automaster: accept spaces between options
  - BBHosts: support more flags and downtime feature (Mathieu Alorent)
  - Bootconf: new lens for OpenBSD's /etc/boot.conf (Jasper Adriaanse)
  - Desktop: Support dos eol
  - Dhclient: read /etc/dhclient.conf used in OpenBSD (Jasper Adriaanse)
  - Dovecot: New lens for dovecot configurations (Serge Smetana)
  - Fai_Diskconfig: Optimize some regexps
  - Fonts: exclude all README files (Jasper Adriaanse)
  - Inetd: support IPv6 addresses, bug #320
  - IniFile: Add lns_loose and lns_loose_multiline definitions
    Support smart quotes
    Warning: Smart quotes support means users should not add
    escaped double quotes themselves. Tests need to be fixed
    also.
    Use standard Util.comment_generic and Util.empty_generic
    Warning: Existing lens tests must be adapted to use standard
    comments and empty lines
    Allow spaces in entry_multiline* values
    Add entry_generic and entry_multiline_generic
    Add empty_generic and empty_noindent
    Let multiline values begin with a single newline
    Support dos eol
    Warning: Support for dos eol means existing lenses usually
    need to be adapted to exclude \r as well as \n.
  - IPRoute2: Support for iproute2 files (Davide Guerri)
  - JaaS: lens for the Java Authentication and Authorization Service
    (Simon Vocella)
  - JettyRealm: new lens for jetty-realm.properties (Brian Harrington)
  - JMXAccess, JMXPassword: new lenses for ActiveMQ's JMX files
    (Brian Harrington)
  - Krb5: Use standard comments and empty lines
    Support dos eol
    Improve performance
    Accept pkinit_anchors (Andrew Anderson)
  - Lightdm: Use standard comments and empty lines
  - LVM: New lens for LVM metadata (Gabriel)
  - Mdadm_conf: optimize some regexps
  - MongoDBServer: new lens (Brian Harrington)
  - Monit: also load /etc/monitrc (Jasper Adriaanse)
  - MySQL: Use standard comments and empty lines
    Support dos eol
  - NagiosCfg: handle Icinga and resources.cfg (Jasper Adriaanse)
  - Nrpe: accept any config option rather than predefined list (Gonzalo
    Servat); optimize some regexps
  - Ntpd: new lense for OpenNTPD config (Jasper Adriaanse)
  - Odbc: Use standard comments and empty lines
  - Openshift_*: new lenses for Openshift support (Brian Harrington)
  - Quote: allow multiple spaces in quote_spaces; improve docs
  - Passwd: allow period in user names in spec, bug #337; allow overrides
    in nisentry
  - PHP: Support smart quotes
    Use standard comments and empty lines
    Load /etc/php*/fpm/pool.d/*.conf (Enrico Stahn)
  - Postfix_master: allow [] in words, bug #345
  - Resolv: support 'lookup' and 'family' key words, bug #320
    (Jasper Adriaanse))
  - Rsyslog: support :omusrmsg: list of users in actions
  - RX: add CR to RX.space_in
  - Samba: Use standard comments and empty lines
    Support dos eol
  - Schroot: Support smart quotes
  - Services: support port ranges (Branan Purvine-Riley)
  - Shellvars: optimize some regexps; reinstate /etc/sysconfig/network,
    fixes bug #330, RHBZ#904222, RHBZ#920609; parse /etc/rc.conf.local
    from OpenBSD
  - Sip_Conf: New lens for sip.conf configurations (Rob Tucker)
  - Splunk: new lens (Tim Brigham)
  - Subversion: Support smart quotes
    Use standard comments and empty lines
    Use IniFile.entry_multiline_generic
    Use IniFile.empty_noindent
    Support dos eol
  - Sudoers: allow user aliases in specs
  - Sysctl: exclude README file
  - Systemd: Support smart quotes; allow backslashes in values
  - Xinetd: handle missing values in list, bug #307
  - Xorg: allow 'Screen' in Device section, bug #344
  - Yum: Support dos eol, optimize some regexps</changelog>
  <changelog author="meissner@suse.com" date="1386936000">- download url changed, also added keyring and .sig ring</changelog>
  <changelog author="mlatimer@suse.com" date="1399291200">- device_map lense: Find device.map in any dir beneath /boot (bnc#875086)
  augeas-device_map-grub2.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1399377600">- Add check phase, comment out as 2 test fails now.
- Clean up with spec-cleaner
- Version bump to 1.2.0:
  - API changes
  * Add aug_cp and the cp and copy commands
  * aug_to_xml now includes span information in the XML dump
  - General changes/additions
  * Fix documentation link in c_api NaturalDocs menu
  * Fix NaturalDocs documentation for various lenses
  * src/transform.c (filter_matches): wrap fnmatch to ensure that an incl
    pattern containing "//" matches file paths, RHBZ#1031084
  * Correct locations table for transform_save() (Tomas Hoger)
  * Corrections for CVE-2012-0786 tests (Tomas Hoger)
  * Fix umask handling when creating new files, RHBZ#1034261
  - Lens changes/additions
  * Access: support DOMAIN\user syntax for users and groups, bug #353
  * Authorized_Keys: Allow 'ssh-ed25519' as a valid authorized_key
    type (Jasper Lievisse Adriaanse)
  * Automounter: Handle hostnames with dashes in them, GH issue #27
  * Build: Add combinatorics group
  * Cyrus_Imapd: Create new entries without space before separator,
    RHBZ#1014974 (Dietmar Kling)
  * Desktop: Support square brackets in keys
  * Dhclient: Add dhclient.conf path for Debian/Ubuntu (Esteve Fernandez)
  * Dhcpd: Support conditionals, GH issue #34
    Support a wider variety of allow/deny statement, including
    booting and bootp (Yanis Guenane)
    Support a wider variety of DHCP allow/deny/ignore statements
    (Yanis Guenane)
  * Dovecot: Various enhancements and bug fixes (Michael Haslgrübler):
    add mailbox to block_names, fix for block_args in quotes,
    fix for block's brackets upon write,
    fixes broken tests for mailbox,
    fixes indention,
    test case for block_args with ",
    fixes broken indention
    Use Quote module
  * Exports: Permit colons for IPv6 client addresses, bug #366
  * Grub: Support the 'setkey' and 'lock' directives
    NFC fix whitespace errors
    Handle makeactive menu command, bug #340
    Add 'verbose' option, GH issue #73
  * Interfaces: Add in support for the source stanza in
    /etc/network/interfaces files
    Map bond-slaves and bridge-ports to arrays (incompatible
    change) (Kaarle Ritvanen)
    Add /etc/network/interfaces.d/* support
    Allow numeric characters in stanza options (Pascal Lalonde)
  * Koji: New lens to parse Koji configs (Pat Riehecky)
  * MongoDBServer: Accept quoted values (Tomas Klouda)
  * NagiosCfg: Do not try to parse /etc/nagios/nrpe.cfg anymore, GH issue #43
    /etc/nagios/nrpe.cfg is parsed by Nrpe (Yanis Guenane)
  * Nagiosobjects: Add support for optional spaces and indents
    and whole-line comments (Sean Millichamp)
  * OpenVPN: Support daemon, client-config-dir, route, and management
    directives (Freakin https://github.com/Freakin)
  * PHP: allow php-fpm syntax in keys, GH issue #35
  * Postfix_Main: Handle stray whitespace at end of multiline lines, bug #348
  * Postfix_virtual: allow '+' and '=' in email addresses (Tom Hendrikx)
  * Properties: support multiline starting with an empty string, GH issue #19
  * Samba: Permit asterisk in key name, bug #354
  * Shellvars: Read /etc/firewalld/firewalld.conf, bug #363
    Support all types of quoted strings in arrays, bug #357
    Exclude /etc/sysconfig/ip*tables.save files
  * Shellvars, Sysconfig: map "bare" export and unset lines to seq numbered
    nodes to handle multiple variables (incompatible change), RHBZ#1033795
  * Shellvars_list: Handle backtick variable assignments, bug #368
    Allow end-of-line comments, bug #342
  * Simplevars: Add /etc/selinux/semanage.conf
  * Slapd: use smart quotes for database entries; rename by/what to by/access;
    allow access to be absent as per official docs (incompatible change)
  * Sshd: Indent Match entries by 2 spaces by default
    Support Ciphers and KexAlgorithms groups, GH issue #69
    Let all special keys be case-insensitive
  * Sudoers: Permit underscores in group names, bug #370 (Matteo Cerutti)
    Allow uppercase characters in user names, bug #376
  * Sysconfig: Permit empty comments after comment lines, RHBZ#1043636
  * Sysconfig_Route: New lens for RedHat's route configs
  * Syslog: Accept UDP(@) and TCP(@@) protocol, bug #364 (Yanis Guenane)
  * Xymon_Alerting: New lens for Xymon alerting files (François Maillard)
  * Yum: Add yum-cron*.conf files (Pat Riehecky)
    Include only *.repo files from yum.repos.d (Andrew N Golovkov)
    Permit spaces after equals sign in list options, GH issue #45
    Split excludes as lists, bug #275</changelog>
  <changelog author="tchvatal@suse.com" date="1404216000">- Enable tests but "pass" them even with 2 failures.</changelog>
  <changelog author="tchvatal@suse.com" date="1404302400">- Change desc to describe the "tools" not just the library
  bnc#885495.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="6491fd1a85c334042a1cfcc1c538c0392ca5694498e6e4f1c4068eb5f1a4f7c0" name="augeas" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="510fd8837f5b01fc64087941e7c46630572626f6412d5956026d6d850e7f0c52" name="augeas" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="794d8e427423bbdafe858f18a4b8146b1237c254a6740ff23ccded01f49a41cf" name="augeas" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="62d104758e62e9ba9b40e170087ad8e84d71b498d0483d4f1a2fe2299fc891f0" name="augeas" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="ce878d632a33d8bdb7801fd37e7a4153634d514cf22af994c384e28ba56129d4" name="augeas" arch="src">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="cfarrell@suse.com" date="1349870400">- license update: GPL-3.0+ and LGPL-2.1+
  semicolon is ambiguous</changelog>
  <changelog author="poelzleithner@b1-systems.de" date="1365336000">- update to 1.0.0
  - drop bnc-729491-recognize-suse-sysconfig-files.patch:
    upstream ShellVars lense now uses /etc/sysconfig/* include filter
  - drop patches, now upstream: augeas-pkgdeps.diff, augeas-stdio.h.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1386676800">- Update to version 1.1.0
  - Handle files with special characters in their name, bug #343
  - Fix type error in composition ('f; g') of functions, bug #328
  - Improve detection of version script; make build work on Illumos with
    GBU ld (Igor Pashev)
  - augparse: add --trace option to print filenames of all modules being
    loaded
  - Various lens documentation improvements (Jasper Lievisse Adriaanse)
  - Lens changes/additions
  - ActiveMQ_*: new lens for ActiveMQ/JBoss A-MQ (Brian Harrington)
  - AptCacherNGSecurity: new lens for /etc/apt-cacher-ng/security.conf
    (Erik Anderson)
  - Automaster: accept spaces between options
  - BBHosts: support more flags and downtime feature (Mathieu Alorent)
  - Bootconf: new lens for OpenBSD's /etc/boot.conf (Jasper Adriaanse)
  - Desktop: Support dos eol
  - Dhclient: read /etc/dhclient.conf used in OpenBSD (Jasper Adriaanse)
  - Dovecot: New lens for dovecot configurations (Serge Smetana)
  - Fai_Diskconfig: Optimize some regexps
  - Fonts: exclude all README files (Jasper Adriaanse)
  - Inetd: support IPv6 addresses, bug #320
  - IniFile: Add lns_loose and lns_loose_multiline definitions
    Support smart quotes
    Warning: Smart quotes support means users should not add
    escaped double quotes themselves. Tests need to be fixed
    also.
    Use standard Util.comment_generic and Util.empty_generic
    Warning: Existing lens tests must be adapted to use standard
    comments and empty lines
    Allow spaces in entry_multiline* values
    Add entry_generic and entry_multiline_generic
    Add empty_generic and empty_noindent
    Let multiline values begin with a single newline
    Support dos eol
    Warning: Support for dos eol means existing lenses usually
    need to be adapted to exclude \r as well as \n.
  - IPRoute2: Support for iproute2 files (Davide Guerri)
  - JaaS: lens for the Java Authentication and Authorization Service
    (Simon Vocella)
  - JettyRealm: new lens for jetty-realm.properties (Brian Harrington)
  - JMXAccess, JMXPassword: new lenses for ActiveMQ's JMX files
    (Brian Harrington)
  - Krb5: Use standard comments and empty lines
    Support dos eol
    Improve performance
    Accept pkinit_anchors (Andrew Anderson)
  - Lightdm: Use standard comments and empty lines
  - LVM: New lens for LVM metadata (Gabriel)
  - Mdadm_conf: optimize some regexps
  - MongoDBServer: new lens (Brian Harrington)
  - Monit: also load /etc/monitrc (Jasper Adriaanse)
  - MySQL: Use standard comments and empty lines
    Support dos eol
  - NagiosCfg: handle Icinga and resources.cfg (Jasper Adriaanse)
  - Nrpe: accept any config option rather than predefined list (Gonzalo
    Servat); optimize some regexps
  - Ntpd: new lense for OpenNTPD config (Jasper Adriaanse)
  - Odbc: Use standard comments and empty lines
  - Openshift_*: new lenses for Openshift support (Brian Harrington)
  - Quote: allow multiple spaces in quote_spaces; improve docs
  - Passwd: allow period in user names in spec, bug #337; allow overrides
    in nisentry
  - PHP: Support smart quotes
    Use standard comments and empty lines
    Load /etc/php*/fpm/pool.d/*.conf (Enrico Stahn)
  - Postfix_master: allow [] in words, bug #345
  - Resolv: support 'lookup' and 'family' key words, bug #320
    (Jasper Adriaanse))
  - Rsyslog: support :omusrmsg: list of users in actions
  - RX: add CR to RX.space_in
  - Samba: Use standard comments and empty lines
    Support dos eol
  - Schroot: Support smart quotes
  - Services: support port ranges (Branan Purvine-Riley)
  - Shellvars: optimize some regexps; reinstate /etc/sysconfig/network,
    fixes bug #330, RHBZ#904222, RHBZ#920609; parse /etc/rc.conf.local
    from OpenBSD
  - Sip_Conf: New lens for sip.conf configurations (Rob Tucker)
  - Splunk: new lens (Tim Brigham)
  - Subversion: Support smart quotes
    Use standard comments and empty lines
    Use IniFile.entry_multiline_generic
    Use IniFile.empty_noindent
    Support dos eol
  - Sudoers: allow user aliases in specs
  - Sysctl: exclude README file
  - Systemd: Support smart quotes; allow backslashes in values
  - Xinetd: handle missing values in list, bug #307
  - Xorg: allow 'Screen' in Device section, bug #344
  - Yum: Support dos eol, optimize some regexps</changelog>
  <changelog author="meissner@suse.com" date="1386936000">- download url changed, also added keyring and .sig ring</changelog>
  <changelog author="mlatimer@suse.com" date="1399291200">- device_map lense: Find device.map in any dir beneath /boot (bnc#875086)
  augeas-device_map-grub2.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1399377600">- Add check phase, comment out as 2 test fails now.
- Clean up with spec-cleaner
- Version bump to 1.2.0:
  - API changes
  * Add aug_cp and the cp and copy commands
  * aug_to_xml now includes span information in the XML dump
  - General changes/additions
  * Fix documentation link in c_api NaturalDocs menu
  * Fix NaturalDocs documentation for various lenses
  * src/transform.c (filter_matches): wrap fnmatch to ensure that an incl
    pattern containing "//" matches file paths, RHBZ#1031084
  * Correct locations table for transform_save() (Tomas Hoger)
  * Corrections for CVE-2012-0786 tests (Tomas Hoger)
  * Fix umask handling when creating new files, RHBZ#1034261
  - Lens changes/additions
  * Access: support DOMAIN\user syntax for users and groups, bug #353
  * Authorized_Keys: Allow 'ssh-ed25519' as a valid authorized_key
    type (Jasper Lievisse Adriaanse)
  * Automounter: Handle hostnames with dashes in them, GH issue #27
  * Build: Add combinatorics group
  * Cyrus_Imapd: Create new entries without space before separator,
    RHBZ#1014974 (Dietmar Kling)
  * Desktop: Support square brackets in keys
  * Dhclient: Add dhclient.conf path for Debian/Ubuntu (Esteve Fernandez)
  * Dhcpd: Support conditionals, GH issue #34
    Support a wider variety of allow/deny statement, including
    booting and bootp (Yanis Guenane)
    Support a wider variety of DHCP allow/deny/ignore statements
    (Yanis Guenane)
  * Dovecot: Various enhancements and bug fixes (Michael Haslgrübler):
    add mailbox to block_names, fix for block_args in quotes,
    fix for block's brackets upon write,
    fixes broken tests for mailbox,
    fixes indention,
    test case for block_args with ",
    fixes broken indention
    Use Quote module
  * Exports: Permit colons for IPv6 client addresses, bug #366
  * Grub: Support the 'setkey' and 'lock' directives
    NFC fix whitespace errors
    Handle makeactive menu command, bug #340
    Add 'verbose' option, GH issue #73
  * Interfaces: Add in support for the source stanza in
    /etc/network/interfaces files
    Map bond-slaves and bridge-ports to arrays (incompatible
    change) (Kaarle Ritvanen)
    Add /etc/network/interfaces.d/* support
    Allow numeric characters in stanza options (Pascal Lalonde)
  * Koji: New lens to parse Koji configs (Pat Riehecky)
  * MongoDBServer: Accept quoted values (Tomas Klouda)
  * NagiosCfg: Do not try to parse /etc/nagios/nrpe.cfg anymore, GH issue #43
    /etc/nagios/nrpe.cfg is parsed by Nrpe (Yanis Guenane)
  * Nagiosobjects: Add support for optional spaces and indents
    and whole-line comments (Sean Millichamp)
  * OpenVPN: Support daemon, client-config-dir, route, and management
    directives (Freakin https://github.com/Freakin)
  * PHP: allow php-fpm syntax in keys, GH issue #35
  * Postfix_Main: Handle stray whitespace at end of multiline lines, bug #348
  * Postfix_virtual: allow '+' and '=' in email addresses (Tom Hendrikx)
  * Properties: support multiline starting with an empty string, GH issue #19
  * Samba: Permit asterisk in key name, bug #354
  * Shellvars: Read /etc/firewalld/firewalld.conf, bug #363
    Support all types of quoted strings in arrays, bug #357
    Exclude /etc/sysconfig/ip*tables.save files
  * Shellvars, Sysconfig: map "bare" export and unset lines to seq numbered
    nodes to handle multiple variables (incompatible change), RHBZ#1033795
  * Shellvars_list: Handle backtick variable assignments, bug #368
    Allow end-of-line comments, bug #342
  * Simplevars: Add /etc/selinux/semanage.conf
  * Slapd: use smart quotes for database entries; rename by/what to by/access;
    allow access to be absent as per official docs (incompatible change)
  * Sshd: Indent Match entries by 2 spaces by default
    Support Ciphers and KexAlgorithms groups, GH issue #69
    Let all special keys be case-insensitive
  * Sudoers: Permit underscores in group names, bug #370 (Matteo Cerutti)
    Allow uppercase characters in user names, bug #376
  * Sysconfig: Permit empty comments after comment lines, RHBZ#1043636
  * Sysconfig_Route: New lens for RedHat's route configs
  * Syslog: Accept UDP(@) and TCP(@@) protocol, bug #364 (Yanis Guenane)
  * Xymon_Alerting: New lens for Xymon alerting files (François Maillard)
  * Yum: Add yum-cron*.conf files (Pat Riehecky)
    Include only *.repo files from yum.repos.d (Andrew N Golovkov)
    Permit spaces after equals sign in list options, GH issue #45
    Split excludes as lists, bug #275</changelog>
  <changelog author="tchvatal@suse.com" date="1404216000">- Enable tests but "pass" them even with 2 failures.</changelog>
  <changelog author="tchvatal@suse.com" date="1404302400">- Change desc to describe the "tools" not just the library
  bnc#885495.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="030800ffb52c416eb26f23ae301aaf687fe8abbf805c354081a4c4134fc165aa" name="augeas" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="a97c540ef122dd8b297365fdfb88641b6de24c3319104c91f6e539f650c4f177" name="augeas" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="7c77c2736df8de4d01e972cfdc786e9f69ba0036d0ef3eeb6016f77a090c4493" name="augeas" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="c14ab729189bb842fe25d32fa08f22eaac0ff2c4a07ea6dbf03edd8e7bd33edc" name="augeas" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="c11d406432d1297bbf39142ddc11fc861cc19d60436957d6e1c557a6f91431bb" name="augeas" arch="src">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="poelzleithner@b1-systems.de" date="1365336000">- update to 1.0.0
  - drop bnc-729491-recognize-suse-sysconfig-files.patch:
    upstream ShellVars lense now uses /etc/sysconfig/* include filter
  - drop patches, now upstream: augeas-pkgdeps.diff, augeas-stdio.h.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1386676800">- Update to version 1.1.0
  - Handle files with special characters in their name, bug #343
  - Fix type error in composition ('f; g') of functions, bug #328
  - Improve detection of version script; make build work on Illumos with
    GBU ld (Igor Pashev)
  - augparse: add --trace option to print filenames of all modules being
    loaded
  - Various lens documentation improvements (Jasper Lievisse Adriaanse)
  - Lens changes/additions
  - ActiveMQ_*: new lens for ActiveMQ/JBoss A-MQ (Brian Harrington)
  - AptCacherNGSecurity: new lens for /etc/apt-cacher-ng/security.conf
    (Erik Anderson)
  - Automaster: accept spaces between options
  - BBHosts: support more flags and downtime feature (Mathieu Alorent)
  - Bootconf: new lens for OpenBSD's /etc/boot.conf (Jasper Adriaanse)
  - Desktop: Support dos eol
  - Dhclient: read /etc/dhclient.conf used in OpenBSD (Jasper Adriaanse)
  - Dovecot: New lens for dovecot configurations (Serge Smetana)
  - Fai_Diskconfig: Optimize some regexps
  - Fonts: exclude all README files (Jasper Adriaanse)
  - Inetd: support IPv6 addresses, bug #320
  - IniFile: Add lns_loose and lns_loose_multiline definitions
    Support smart quotes
    Warning: Smart quotes support means users should not add
    escaped double quotes themselves. Tests need to be fixed
    also.
    Use standard Util.comment_generic and Util.empty_generic
    Warning: Existing lens tests must be adapted to use standard
    comments and empty lines
    Allow spaces in entry_multiline* values
    Add entry_generic and entry_multiline_generic
    Add empty_generic and empty_noindent
    Let multiline values begin with a single newline
    Support dos eol
    Warning: Support for dos eol means existing lenses usually
    need to be adapted to exclude \r as well as \n.
  - IPRoute2: Support for iproute2 files (Davide Guerri)
  - JaaS: lens for the Java Authentication and Authorization Service
    (Simon Vocella)
  - JettyRealm: new lens for jetty-realm.properties (Brian Harrington)
  - JMXAccess, JMXPassword: new lenses for ActiveMQ's JMX files
    (Brian Harrington)
  - Krb5: Use standard comments and empty lines
    Support dos eol
    Improve performance
    Accept pkinit_anchors (Andrew Anderson)
  - Lightdm: Use standard comments and empty lines
  - LVM: New lens for LVM metadata (Gabriel)
  - Mdadm_conf: optimize some regexps
  - MongoDBServer: new lens (Brian Harrington)
  - Monit: also load /etc/monitrc (Jasper Adriaanse)
  - MySQL: Use standard comments and empty lines
    Support dos eol
  - NagiosCfg: handle Icinga and resources.cfg (Jasper Adriaanse)
  - Nrpe: accept any config option rather than predefined list (Gonzalo
    Servat); optimize some regexps
  - Ntpd: new lense for OpenNTPD config (Jasper Adriaanse)
  - Odbc: Use standard comments and empty lines
  - Openshift_*: new lenses for Openshift support (Brian Harrington)
  - Quote: allow multiple spaces in quote_spaces; improve docs
  - Passwd: allow period in user names in spec, bug #337; allow overrides
    in nisentry
  - PHP: Support smart quotes
    Use standard comments and empty lines
    Load /etc/php*/fpm/pool.d/*.conf (Enrico Stahn)
  - Postfix_master: allow [] in words, bug #345
  - Resolv: support 'lookup' and 'family' key words, bug #320
    (Jasper Adriaanse))
  - Rsyslog: support :omusrmsg: list of users in actions
  - RX: add CR to RX.space_in
  - Samba: Use standard comments and empty lines
    Support dos eol
  - Schroot: Support smart quotes
  - Services: support port ranges (Branan Purvine-Riley)
  - Shellvars: optimize some regexps; reinstate /etc/sysconfig/network,
    fixes bug #330, RHBZ#904222, RHBZ#920609; parse /etc/rc.conf.local
    from OpenBSD
  - Sip_Conf: New lens for sip.conf configurations (Rob Tucker)
  - Splunk: new lens (Tim Brigham)
  - Subversion: Support smart quotes
    Use standard comments and empty lines
    Use IniFile.entry_multiline_generic
    Use IniFile.empty_noindent
    Support dos eol
  - Sudoers: allow user aliases in specs
  - Sysctl: exclude README file
  - Systemd: Support smart quotes; allow backslashes in values
  - Xinetd: handle missing values in list, bug #307
  - Xorg: allow 'Screen' in Device section, bug #344
  - Yum: Support dos eol, optimize some regexps</changelog>
  <changelog author="meissner@suse.com" date="1386936000">- download url changed, also added keyring and .sig ring</changelog>
  <changelog author="mlatimer@suse.com" date="1399291200">- device_map lense: Find device.map in any dir beneath /boot (bnc#875086)
  augeas-device_map-grub2.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1399377600">- Add check phase, comment out as 2 test fails now.
- Clean up with spec-cleaner
- Version bump to 1.2.0:
  - API changes
  * Add aug_cp and the cp and copy commands
  * aug_to_xml now includes span information in the XML dump
  - General changes/additions
  * Fix documentation link in c_api NaturalDocs menu
  * Fix NaturalDocs documentation for various lenses
  * src/transform.c (filter_matches): wrap fnmatch to ensure that an incl
    pattern containing "//" matches file paths, RHBZ#1031084
  * Correct locations table for transform_save() (Tomas Hoger)
  * Corrections for CVE-2012-0786 tests (Tomas Hoger)
  * Fix umask handling when creating new files, RHBZ#1034261
  - Lens changes/additions
  * Access: support DOMAIN\user syntax for users and groups, bug #353
  * Authorized_Keys: Allow 'ssh-ed25519' as a valid authorized_key
    type (Jasper Lievisse Adriaanse)
  * Automounter: Handle hostnames with dashes in them, GH issue #27
  * Build: Add combinatorics group
  * Cyrus_Imapd: Create new entries without space before separator,
    RHBZ#1014974 (Dietmar Kling)
  * Desktop: Support square brackets in keys
  * Dhclient: Add dhclient.conf path for Debian/Ubuntu (Esteve Fernandez)
  * Dhcpd: Support conditionals, GH issue #34
    Support a wider variety of allow/deny statement, including
    booting and bootp (Yanis Guenane)
    Support a wider variety of DHCP allow/deny/ignore statements
    (Yanis Guenane)
  * Dovecot: Various enhancements and bug fixes (Michael Haslgrübler):
    add mailbox to block_names, fix for block_args in quotes,
    fix for block's brackets upon write,
    fixes broken tests for mailbox,
    fixes indention,
    test case for block_args with ",
    fixes broken indention
    Use Quote module
  * Exports: Permit colons for IPv6 client addresses, bug #366
  * Grub: Support the 'setkey' and 'lock' directives
    NFC fix whitespace errors
    Handle makeactive menu command, bug #340
    Add 'verbose' option, GH issue #73
  * Interfaces: Add in support for the source stanza in
    /etc/network/interfaces files
    Map bond-slaves and bridge-ports to arrays (incompatible
    change) (Kaarle Ritvanen)
    Add /etc/network/interfaces.d/* support
    Allow numeric characters in stanza options (Pascal Lalonde)
  * Koji: New lens to parse Koji configs (Pat Riehecky)
  * MongoDBServer: Accept quoted values (Tomas Klouda)
  * NagiosCfg: Do not try to parse /etc/nagios/nrpe.cfg anymore, GH issue #43
    /etc/nagios/nrpe.cfg is parsed by Nrpe (Yanis Guenane)
  * Nagiosobjects: Add support for optional spaces and indents
    and whole-line comments (Sean Millichamp)
  * OpenVPN: Support daemon, client-config-dir, route, and management
    directives (Freakin https://github.com/Freakin)
  * PHP: allow php-fpm syntax in keys, GH issue #35
  * Postfix_Main: Handle stray whitespace at end of multiline lines, bug #348
  * Postfix_virtual: allow '+' and '=' in email addresses (Tom Hendrikx)
  * Properties: support multiline starting with an empty string, GH issue #19
  * Samba: Permit asterisk in key name, bug #354
  * Shellvars: Read /etc/firewalld/firewalld.conf, bug #363
    Support all types of quoted strings in arrays, bug #357
    Exclude /etc/sysconfig/ip*tables.save files
  * Shellvars, Sysconfig: map "bare" export and unset lines to seq numbered
    nodes to handle multiple variables (incompatible change), RHBZ#1033795
  * Shellvars_list: Handle backtick variable assignments, bug #368
    Allow end-of-line comments, bug #342
  * Simplevars: Add /etc/selinux/semanage.conf
  * Slapd: use smart quotes for database entries; rename by/what to by/access;
    allow access to be absent as per official docs (incompatible change)
  * Sshd: Indent Match entries by 2 spaces by default
    Support Ciphers and KexAlgorithms groups, GH issue #69
    Let all special keys be case-insensitive
  * Sudoers: Permit underscores in group names, bug #370 (Matteo Cerutti)
    Allow uppercase characters in user names, bug #376
  * Sysconfig: Permit empty comments after comment lines, RHBZ#1043636
  * Sysconfig_Route: New lens for RedHat's route configs
  * Syslog: Accept UDP(@) and TCP(@@) protocol, bug #364 (Yanis Guenane)
  * Xymon_Alerting: New lens for Xymon alerting files (François Maillard)
  * Yum: Add yum-cron*.conf files (Pat Riehecky)
    Include only *.repo files from yum.repos.d (Andrew N Golovkov)
    Permit spaces after equals sign in list options, GH issue #45
    Split excludes as lists, bug #275</changelog>
  <changelog author="tchvatal@suse.com" date="1404216000">- Enable tests but "pass" them even with 2 failures.</changelog>
  <changelog author="tchvatal@suse.com" date="1404302400">- Change desc to describe the "tools" not just the library
  bnc#885495.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="2a86581150ac2a20c7dd924d35a9d3f81a6cc4ae63e8169a5ec8622e66d98342" name="augeas" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="074e64fae1409dd7a185d6e834ee74b8250a0c24469d52b5a7932a881ee88e02" name="augeas-devel" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="3cd0a9841a5cdffc6ee2b99f755b0b2d03702eb5efc90021b0c27e812954ba61" name="augeas-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="6c18df78beb159dcb0aa7457953d04917bdab4401c3ac9a0feee8ed2fd072b91" name="augeas-devel" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="6dac48d03141df69c1f142a12d158d16fe82a7c63c9a997118287618fa61b2d8" name="augeas-devel" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="bcd337f8aafb6bd28f3891e8202757c14beda291486556a47468b3a0da0fc209" name="augeas-devel" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="48a58dfb8e56645d02ccbd202b084a9f07d31b5bf9c20c1fcfc99b51622caca7" name="augeas-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="8403a095c4ae1ea10d9168b6a2b300c296be7cced1eb5088a6c420d449800645" name="augeas-devel" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="e571d06422b1b33661dae895206c7e513b8c4d71dc0428cdf8903c63128fb7c9" name="augeas-devel" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="4604b25712c57b4b9b4b1f68288d194c1a8f85b1e0427e7e29b45705f75fe693" name="augeas-devel" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="cfc24f4d16ce66e51d23c44be4fb2647c98356298532a8edcb96e23679156e45" name="augeas-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="05dc6a4bc270ac658a5e1220bed8912261c78af4ac60b42a23b60dd2c0a45afd" name="augeas-devel" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="1eb16fbb9576bffd9a2d697556bb48c016170c6e52e6e02ec08e7d83e17825b7" name="augeas-devel" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="d051314a1d485834f3a13a1f8e45b9d5b17fe0f5fbaab09f1a7db485f90292b2" name="augeas-devel" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="e6b6d6660589762fe941ea61413e05830ceac7ec169a8cf059d0e677f46ebf36" name="augeas-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="1d83cf87e131d5ef7dbb1815e704823558e0bf7b58f58901f2fd29dc95939923" name="augeas-devel" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="335cb396f758b334112ce34137384704ca8139720bfceec0ce45933627f51b7e" name="augeas-devel" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="6aa130b423a6b37398804363c3319a37d664476b4b6c8589b21bdd78e2fa38a5" name="augeas-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="fbff77a07fa4f739eb83f4dfa4b84bc6e0476686370c26f0fc000ead225f84e1" name="augeas-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="adbe242d8d6784ac91db8e7503070467b51b8d361caa91f891d6a4c0264be7e0" name="augeas-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="caab87224a4269fc6ee11dfe709ced7851d83ba1345c33480b2caae37251bbc4" name="augeas-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="6b51222c096c87bac24eb869b025fc401133bddba05cabb1e2057047f73727a2" name="augeas-lense-tests" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="e5afa85021c7672e56de047dcfbd427de781cd6f2d9e7db1f3d2958e300c3119" name="augeas-lense-tests" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="698d26919c239314189e758d8c4812efb17c912035048417abbaac4728988675" name="augeas-lense-tests" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="e3dc6ba8171aa29a10dd80535baa9cacd8e7f2105daafb64c490354c4a552125" name="augeas-lense-tests" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="37c10ff76b87814f93c035ce60bc7c03a4ec4be3d31192be407677f6d4d2c4d2" name="augeas-lense-tests" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="8e0d0b7b55ac5de4bb3d2d425254feffa10725c0431f54e43762cf052556be60" name="augeas-lense-tests" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="66dc34e7b114cd2295461cfd4a101f16f76484ecc002bdf2846e96b17d7ea949" name="augeas-lense-tests" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="b82f1e14d5ba1c134e428c19096551fabb3f87366555b67490e8094fb1f09f6b" name="augeas-lense-tests" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="2cf739a018f6c57bc7bea0055d4a5be3edfd9cdf47b4769884ca172c62746fd2" name="augeas-lense-tests" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="875e8d7d7bb1d862aa56fe0f9310ef7e009eec61d7e29b9e5e6e591b22031ae1" name="augeas-lense-tests" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="4570c04403735f27bbc6d725bdb1100f9f0e523edbdd5804c283aedc3e776fab" name="augeas-lense-tests" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="466c7d77508e5e620ecdd2944a169005d0e1373331b3c6844ca4d52d6ca9a98a" name="augeas-lense-tests" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="1b7503f5ccb3fb61a579e9ac01935ffe8e5a3f7a6bfc6d1bed8084dd2c37f300" name="augeas-lense-tests" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="7948b40715a7d9aac6e5663fe67850858aa99d4710beecb1798ff1a29e05bb39" name="augeas-lense-tests" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="2d26b34fa5fdd40701f680d32e9bd9fac1ac4b303b2a5bd88fa59c72e3b15bb8" name="augeas-lense-tests" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="86cf7f3de0ad1b197bd8868d121eca17dcaffca51f6327bf75be7c87d5214110" name="augeas-lense-tests" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="32a564fb224e3fc9c811dc6432e9148de886a2d251a7b4dd9aba910af2484ad4" name="augeas-lenses" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="c534e894868566853909d6dc55f238d8d287bf09e4e8632c430f377f8fa754d8" name="augeas-lenses" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="d8871c36f92f87b116496b2525902b95fccdd7c30b2c235e8e73026d13c21e66" name="augeas-lenses" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="f0979359b98081edcd1ebdd2f2875598a571acbd35ee691796b544ba0679ceaa" name="augeas-lenses" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
  <changelog author="david.anes@suse.com" date="1649246400">- add augeas-sysctl_parsing.patch (bsc#1197443)
  * backport original patch and rebase</changelog>
</package>
<package pkgid="195bbc53dc10e268946026def1b772aa7ad58d04463335b66036e5afeef645fa" name="augeas-lenses" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="2406be8720e08dc83ce615fbf21824e532b5fcb39e12b673e867c30af2105958" name="augeas-lenses" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="42e9211bfc255ef3e6d2536df5fca8ba5758644ee8b8d83aeba2f9cb96dabd9d" name="augeas-lenses" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="a694332dcab968e85f3744501699fd6f653018af820da0a265e8121b5ea2d26e" name="augeas-lenses" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="8ab935a9d028fe5bd56d58aad2ab4d8f3de999296aae4b77c823f3827382d0de" name="augeas-lenses" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="512d0746881d19c8465d1a8bba5b30bc275a84c5c0adf39e751d74265d0738c2" name="augeas-lenses" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="a4c7937c65b8d175e80e327714e0a0a7e74509c68048659e5972bdd75c38e589" name="augeas-lenses" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="480b90ffaab13187c837e6fa6ea81ddb5db26e6db5a86a7963516da103927cf2" name="augeas-lenses" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.5.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="029fb986057333498d5a777624d83b4b442ab0357a9cacfb6f1c8a173d350b02" name="augeas-lenses" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="a3037dd0decbcbafae84511fd4072806f6fca832ed47437147b4c874ee88a5c2" name="augeas-lenses" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="3f676be260ba1ba1f8cf9d11f5c703cec73cb28ec35c67920e49131dd99fc709" name="augeas-lenses" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="36036635a0535909df883614b03cc52ff7dee9cc5ab0639c493128a83526ad66" name="augeas-lenses" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
  <changelog author="meissner@suse.com" date="1645531200">- support new chrony 4.1 options (jsc#SLE-17334)
  augeas-new_options_for_chrony.patch</changelog>
</package>
<package pkgid="f372306e23971bab2cc04798e39fe0f3a01c7358b13aedcdcba5b1359251df81" name="autofs" arch="aarch64">
  <version epoch="0" ver="5.1.3" rel="150000.7.11.1"/>
  <changelog author="lchiquitto@suse.com" date="1431864000">- update to version 5.1.1:
  * fix compile error in defaults.c
  * add serialization to sasl init
  * dont allocate dev_ctl_ops too early
  * fix incorrect round robin host detection
  * fix race accessing qdn in get_query_dn()
  * fix leak in cache_push_mapent()
  * fix config entry read buffer not checked
  * fix FILE pointer check in defaults_read_config()
  * fix memory leak in conf_amd_get_log_options()
  * fix signed comparison in inet_fill_net()
  * fix buffer size checks in get_network_proximity()
  * fix leak in get_network_proximity()
  * fix buffer size checks in merge_options()
  * check amd lex buffer len before copy
  * add return check in ldap check_map_indirect()
  * check host macro is set before use
  * check options length before use in parse_amd.c
  * fix some out of order evaluations in parse_amd.c
  * fix copy and paste error in dup_defaults_entry()
  * fix leak in parse_mount()
  * add mutex call return check in defaults.c
  * force disable browse mode for amd format maps
  * fix hosts map options check in lookup_amd_instance()
  * fix memory leak in create_client()
  * fix memory leak in get_exports()
  * fix memory leak in get_defaults_entry()
  * fix out of order clearing of options buffer
  * fix reset amd lexer scan buffer
  * ignore multiple commas in options strings
  * fix typo in flagdir configure option
  * clarify multiple mounts description
  * gaurd against incorrect umount return
  * update man page autofs(8) for systemd
  * dont pass sloppy option for other than nfs mounts
  * make service want network-online
  * fix fix master map type check
  * init qdn before use in get_query_dn()
  * fix typo in update_hosts_mounts()
  * fix hosts map update on reload
  * make negative cache update consistent for all lookup modules
  * ensure negative cache isn't updated on remount
  * dont add wildcard to negative cache
  * add a prefix to program map stdvars
  * add config option to force use of program map stdvars
  * fix incorrect check in parse_mount()
  * handle duplicates in multi mounts
  * revert special case cifs escapes
  * fix map option parsing for 'strictatime'
  * fix showmount search in auto.net
  * remove obsolete comment in auto.net
  * fix macro usage in lookup_program.c
  * fix gcc5 complaints
  * remove unused offset handling code
  * fix mount as you go offset selection
  * link daemon with pthread library (Debian patch)
  * manpage corrections (Debian patch)
  * fix manpages hyphenation (Debian patch).
- ported patches:
  * autofs-5.1.0-dbus-udisks-monitor.patch -&gt;
    autofs-5.1.1-dbus-udisks-monitor.patch
  * autofs-debuginfo-fix.patch -&gt; autofs-5.1.1-debuginfo-fix.patch
  * autofs-5.0.9-suse-auto_master_default.patch -&gt;
    autofs-5.1.1-suse-auto_master_default.patch
  * autofs-5.0.9-task-use-after-free.patch -&gt;
    autofs-5.1.1-task-use-after-free.patch
- remove patches that are now upstream:
  * autofs-5.1.0-dont-pass-sloppy-option-for-other-than-nfs-mounts.patch
  * autofs-5.1.0-add-a-prefix-to-program-map-stdvars.patch
  * autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch
  * autofs-5.1.0-gcc5-fixes.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233600">- autofs.service: Use KillMode=mixed so "KillSignal" (SIGTERM) is
  only sent to the main process and if still does not exit after
  "TimeoutStopSec" then "SendSIGKILL" is sent to all remaining
  processes of the unit's control group.
  This is the desired behaviour for almost all daemons that
  execute foreign programs.</changelog>
  <changelog author="ro@suse.de" date="1449576000">- add patch autofs-5.1.1-leave_auth_destroy.patch (bnc#958410)
  do not redefined auth_destroy, the reason for this has long
  been fixed in libtirpc (version 0.2.1 is already fine)</changelog>
  <changelog author="jeffm@suse.com" date="1458820800">- improve scalability of direct mount path component creation (bsc#966573).
  * Added autofs-improve-scalability-of-direct-mount-path-comp.patch
  * Refreshed autofs-5.1.1-dbus-udisks-monitor.patch
- Use libldap_r instead of libldap for thread safety (bsc#955477).
  * Added autofs-use-libldap_r-instead-of-libldap-for-thread-safety.patch</changelog>
  <changelog author="jeffm@suse.com" date="1470830400">- Fix spurious ELOOP on certain kinds of failures (bsc#968918):
  * autofs: fix yp map age not updated in s/_/./g case
  * autofs: properly handle errors in lookup_nss_mount
  * Added patches:
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch</changelog>
  <changelog author="astieger@suse.com" date="1491480000">- remove rpmlintrc, review was boo#782691</changelog>
  <changelog author="jeffm@suse.com" date="1502280000">- update to version 5.1.3:
  * limit getgrgid_r() buffer size
  * increase worker thread per-thread stack size
  * fix offset mount location multiple expansion
  * use malloc for expanded map location
  * fix invalid reference in remount_active_mount()
  * fix work around sss startup delay
  * fix possible NULL derefernce
  * use autofs_point to store expire timeout where possibe
  * add config option to use mount request log id
  * factor out set_thread_mount_request_log_id()
  * log functions to prefix messages with attempt_id if available
  * create thread-local ID for mount attempts
  * add the mount requestor's pid to pending_args
  * delay submount exit for amd submounts
  * fix bogus check in expire_cleanup()
  * handle amd cache option all in amd type auto mounts
  * handle map_option cache for top level mounts
  * capture cache option and its settings during parsing
  * add function conf_amd_get_map_options()
  * check for conflicting amd section mounts
  * include amd mount section mounts in master mounts list
  * add function conf_amd_get_mount_paths()
  * add function conf_amd_get_map_name()
  * add support for amd browsable option
  * add ref counting to struct map_source
  * fix typos in README.amd-maps
  * honor last rw in mount options when doing a bind mount
  * set autofs mounts catatonic at exit
  * make set_direct_mount_catatonic() more general
  * check NFS server availability on local mount fallback
  * make lookup_nss_read_master() return nss status
  * don't return until after master map retry read
  * set sane default master read wait timeout
  * dont exit on master map read fail timeout
  * fix included master map not found return
  * fix quoted key handling in sanitize_path()
  * add sss master map wait config option
  * work around sss startup delay
  * add master read wait option
  * wait for master map available at start
  * update and add README for old autofs schema
  * fix create_client() RPC client handling
  * fix _strncmp() usage
  * fix argc off by one in mount_autofs.c
  * fix cachefs parse message not being logged
  * fix typo in MOUNT_FLAG_GHOST comment
  * Avoid local variable name shadowing another
  * configure: add cache variable for Linux proc filesystem check
  * fix count_mounts() function
  * fix short memory allocation in lookup_amd_instance()
  * Fix fgets(3) size argument (another one)
  * Fix typos in error messages
  * Remove unused local 2KB buffer
  * fix file map changed check
  * Change .requestor to .requester for consistency
  * Fix a typo in CREDITS
  * fix libtirpc detection with -Wl,--as-needed
  * Fix size arg of fgets(3)
  * Drop redundant \n in logerr()
  * Fix compiler warning in try_remount()
  * build: check for clock_gettime in librt
  * fix possible memory leak in nfs mount
  * add config option to suppress not found log message
  * properly handle errors in lookup_nss_mount
  * fix yp map age not updated during map lookup
  * fix 'nameing' typo in autofs.conf
  * add remote-fs.target systemd dependency
  * add autofs(5) note of IPv6 libtirpc requirement
  * fix autofs(5) description of supported map sources
  * fix modules make clean target
  * fix Makefile linking dependencies
  * fix handle_mounts() termination condition check
  * log pipe read errors
  * fix use-after-free in st_queue_handler()
  * always set direct mounts catatonic at exit
  * improve scalability of direct mount path component
  * fix use after free in match_my_name()
  * fix memory leak in get_network_proximity()
  * fix typo in autofs_sasl_bind()
  * fix use after free in open_lookup()
  * fix use after free in sun parser parse_init()
  * fix memory leak in ldap do_init()
  * fix memory leak in nisplus lookup_reinit()
  * fix sasl connection concurrancy problem
  * fix unbind sasl external mech
  * remove unused function elapsed()
  * change time() to use monotonic_clock()
  * change remaining gettimeofday() to use clock_gettime()
  * use monotonic clock for indirect mount condition
  * use monotonic clock for direct mount condition
  * define pending condition init helper function
  * use monotonic clock for alarm thread condition wait
  * define monotonic clock helper functions
  * Add a mode option for master map entries
  * fix error handling of is_mounted()
  * fix out of order call in program map lookup
  * add configuration option to use fqdn in mounts
  * update map_hash_table_size description
  * change lookup to use reinit instead of reopen
  * implement reinit in multi lookup module
  * fix map format check in nss_open_lookup() multi map module
  * factor out alloc multi map context
  * factor out free multi map context
  * add type to struct lookup_mod
  * implement reinit in yp lookup module
  * implement reinit in sss lookup module
  * implement reinit in program lookup module
  * implement reinit in nisplus lookup module
  * implement reinit in ldap lookup module
  * implement reinit in hosts lookup module
  * implement reinit in hesiod lookup module
  * implement reinit in file lookup module
  * implement reinit in dir lookup module
  * implement reinit in parse modules
  * add reinit entry point to modules
  * fix nsswitch handling when opening multi map
  * make open_lookup() return nss status
  * move check_nss_result() to nsswitchr.c
  * fix update_hosts_mounts() return
  * fix missing source sss in multi map lookup
  * fix direct map expire not set for initial empty map
  * fix direct mount stale instance flag reset
  * fix error handling on ldap bind fail
  * fix config old name lookup
  * fix rwlock unlock crash
  * fix return handling of do_reconnect() in ldap module
  * make find_server() return a status
  * make find_dc_server() return a status
  * make connect_to_server() return a status
  * make do_connect() return a status
  * move query dn calculation from do_bind() to do_connect()
  * fix return handling in sss lookup module
  * fix left mount count return from umount_multi_triggers()
  * revert fix libtirpc name clash
  * update libtirpc workaround for new soname
  * fix fix gcc5 complaints
  * Removed patches:
    autofs-5.1.1-task-use-after-free.patch
    autofs-improve-scalability-of-direct-mount-path-comp.patch
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch
    autofs-5.1.1-leave_auth_destroy.patch
  * Updated patches for context:
    autofs-5.1.1-dbus-udisks-monitor.patch</changelog>
  <changelog author="jeffm@suse.com" date="1502280001">- Update URL to use www.kernel.org now that ftp is gone.</changelog>
  <changelog author="jeffm@suse.com" date="1502798400">- Add gpg signature</changelog>
  <changelog author="kukuk@suse.de" date="1502798401">- Add libnsl-devel as build require in preparation of libnsl
  removal from glibc</changelog>
  <changelog author="jeffm@suse.com" date="1508328000">- fix ordering of seteuid/setegid in do_spawn (bsc#1062482).
- fix unset tsd group name handling (bsc#1062482).
- fix possible map instance memory leak (bsc#1038198).
- check map instances for staleness on map update (bsc#1038198).
- Added patches:
  - autofs-5-1-3-check-map-instances-for-staleness-on-map-update.patch
  - autofs-5-1-3-fix-ordering-of-seteuid-setegid-in-do_spawn.patch
  - autofs-5-1-3-fix-possible-map-instance-memory-leak.patch
  - autofs-5-1-3-fix-unset-tsd-group-name-handling.patch</changelog>
  <changelog author="kukuk@suse.de" date="1510488000">- Add build require for rpcgen (preparation for removing it from
  glibc)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="nfbrown@suse.com" date="1517745600">- 0001-use_hostname_for_mounts-shouldn-t-prevent-selection-.patch
  Fix handling of replicated NFS server so that
  selection between servers still works sensibly when
  use_hostname_for_mounts is in effect.
  (bsc#1066720)
- 0002-Fix-monotonic_elapsed.patch
  Fix bug introduced with monotonic-time patches which
  causes nanoseconds to be ignored and effectively
  disables sorting based on response time and/or weight.
  (bsc#1066720)</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- BuildRequire pkgconfig(udisks2) instead of udisks2-devel: let's
  be flexible on possible package name changes.
- Package COPYRIGHT as %license instead of %doc.</changelog>
  <changelog author="nfbrown@suse.com" date="1526472000">- 0003-autofs-5.1.4-fix-fd-leak-in-rpc_do_create_client.patch
  Fix filedescriptor leak (bsc#1093436)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619092800">- Update pidfile path to /run from /var/run (bsc#1185155)</changelog>
  <changelog author="nfbrown@suse.com" date="1644840000">- 0004-autofs-5.1.3-add-port-parameter-to-rpc_ping.patch
  Suppress portmap calls when port explicitly given
  (bsc#1195697)</changelog>
  <changelog author="nfbrown@suse.com" date="1647259200">- 0005-autofs-5.1.4-fix-incorrect-locking-in-sss-lookup.patch
  Fix locking problem that causes deadlock when sss used.
  (bsc#1196485)</changelog>
  <changelog author="nfbrown@suse.com" date="1647345600">- autofs-5.1.6-fix-quoted-string-length-calc-in-expand.patch
  Fix problem with quote handling
  (bsc#1181715)</changelog>
</package>
<package pkgid="8c5fe6c9a51261801399b215b15a9f59f024b8cebce186a1d778d396910ff482" name="autofs" arch="ppc64le">
  <version epoch="0" ver="5.1.3" rel="150000.7.11.1"/>
  <changelog author="lchiquitto@suse.com" date="1431864000">- update to version 5.1.1:
  * fix compile error in defaults.c
  * add serialization to sasl init
  * dont allocate dev_ctl_ops too early
  * fix incorrect round robin host detection
  * fix race accessing qdn in get_query_dn()
  * fix leak in cache_push_mapent()
  * fix config entry read buffer not checked
  * fix FILE pointer check in defaults_read_config()
  * fix memory leak in conf_amd_get_log_options()
  * fix signed comparison in inet_fill_net()
  * fix buffer size checks in get_network_proximity()
  * fix leak in get_network_proximity()
  * fix buffer size checks in merge_options()
  * check amd lex buffer len before copy
  * add return check in ldap check_map_indirect()
  * check host macro is set before use
  * check options length before use in parse_amd.c
  * fix some out of order evaluations in parse_amd.c
  * fix copy and paste error in dup_defaults_entry()
  * fix leak in parse_mount()
  * add mutex call return check in defaults.c
  * force disable browse mode for amd format maps
  * fix hosts map options check in lookup_amd_instance()
  * fix memory leak in create_client()
  * fix memory leak in get_exports()
  * fix memory leak in get_defaults_entry()
  * fix out of order clearing of options buffer
  * fix reset amd lexer scan buffer
  * ignore multiple commas in options strings
  * fix typo in flagdir configure option
  * clarify multiple mounts description
  * gaurd against incorrect umount return
  * update man page autofs(8) for systemd
  * dont pass sloppy option for other than nfs mounts
  * make service want network-online
  * fix fix master map type check
  * init qdn before use in get_query_dn()
  * fix typo in update_hosts_mounts()
  * fix hosts map update on reload
  * make negative cache update consistent for all lookup modules
  * ensure negative cache isn't updated on remount
  * dont add wildcard to negative cache
  * add a prefix to program map stdvars
  * add config option to force use of program map stdvars
  * fix incorrect check in parse_mount()
  * handle duplicates in multi mounts
  * revert special case cifs escapes
  * fix map option parsing for 'strictatime'
  * fix showmount search in auto.net
  * remove obsolete comment in auto.net
  * fix macro usage in lookup_program.c
  * fix gcc5 complaints
  * remove unused offset handling code
  * fix mount as you go offset selection
  * link daemon with pthread library (Debian patch)
  * manpage corrections (Debian patch)
  * fix manpages hyphenation (Debian patch).
- ported patches:
  * autofs-5.1.0-dbus-udisks-monitor.patch -&gt;
    autofs-5.1.1-dbus-udisks-monitor.patch
  * autofs-debuginfo-fix.patch -&gt; autofs-5.1.1-debuginfo-fix.patch
  * autofs-5.0.9-suse-auto_master_default.patch -&gt;
    autofs-5.1.1-suse-auto_master_default.patch
  * autofs-5.0.9-task-use-after-free.patch -&gt;
    autofs-5.1.1-task-use-after-free.patch
- remove patches that are now upstream:
  * autofs-5.1.0-dont-pass-sloppy-option-for-other-than-nfs-mounts.patch
  * autofs-5.1.0-add-a-prefix-to-program-map-stdvars.patch
  * autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch
  * autofs-5.1.0-gcc5-fixes.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233600">- autofs.service: Use KillMode=mixed so "KillSignal" (SIGTERM) is
  only sent to the main process and if still does not exit after
  "TimeoutStopSec" then "SendSIGKILL" is sent to all remaining
  processes of the unit's control group.
  This is the desired behaviour for almost all daemons that
  execute foreign programs.</changelog>
  <changelog author="ro@suse.de" date="1449576000">- add patch autofs-5.1.1-leave_auth_destroy.patch (bnc#958410)
  do not redefined auth_destroy, the reason for this has long
  been fixed in libtirpc (version 0.2.1 is already fine)</changelog>
  <changelog author="jeffm@suse.com" date="1458820800">- improve scalability of direct mount path component creation (bsc#966573).
  * Added autofs-improve-scalability-of-direct-mount-path-comp.patch
  * Refreshed autofs-5.1.1-dbus-udisks-monitor.patch
- Use libldap_r instead of libldap for thread safety (bsc#955477).
  * Added autofs-use-libldap_r-instead-of-libldap-for-thread-safety.patch</changelog>
  <changelog author="jeffm@suse.com" date="1470830400">- Fix spurious ELOOP on certain kinds of failures (bsc#968918):
  * autofs: fix yp map age not updated in s/_/./g case
  * autofs: properly handle errors in lookup_nss_mount
  * Added patches:
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch</changelog>
  <changelog author="astieger@suse.com" date="1491480000">- remove rpmlintrc, review was boo#782691</changelog>
  <changelog author="jeffm@suse.com" date="1502280000">- update to version 5.1.3:
  * limit getgrgid_r() buffer size
  * increase worker thread per-thread stack size
  * fix offset mount location multiple expansion
  * use malloc for expanded map location
  * fix invalid reference in remount_active_mount()
  * fix work around sss startup delay
  * fix possible NULL derefernce
  * use autofs_point to store expire timeout where possibe
  * add config option to use mount request log id
  * factor out set_thread_mount_request_log_id()
  * log functions to prefix messages with attempt_id if available
  * create thread-local ID for mount attempts
  * add the mount requestor's pid to pending_args
  * delay submount exit for amd submounts
  * fix bogus check in expire_cleanup()
  * handle amd cache option all in amd type auto mounts
  * handle map_option cache for top level mounts
  * capture cache option and its settings during parsing
  * add function conf_amd_get_map_options()
  * check for conflicting amd section mounts
  * include amd mount section mounts in master mounts list
  * add function conf_amd_get_mount_paths()
  * add function conf_amd_get_map_name()
  * add support for amd browsable option
  * add ref counting to struct map_source
  * fix typos in README.amd-maps
  * honor last rw in mount options when doing a bind mount
  * set autofs mounts catatonic at exit
  * make set_direct_mount_catatonic() more general
  * check NFS server availability on local mount fallback
  * make lookup_nss_read_master() return nss status
  * don't return until after master map retry read
  * set sane default master read wait timeout
  * dont exit on master map read fail timeout
  * fix included master map not found return
  * fix quoted key handling in sanitize_path()
  * add sss master map wait config option
  * work around sss startup delay
  * add master read wait option
  * wait for master map available at start
  * update and add README for old autofs schema
  * fix create_client() RPC client handling
  * fix _strncmp() usage
  * fix argc off by one in mount_autofs.c
  * fix cachefs parse message not being logged
  * fix typo in MOUNT_FLAG_GHOST comment
  * Avoid local variable name shadowing another
  * configure: add cache variable for Linux proc filesystem check
  * fix count_mounts() function
  * fix short memory allocation in lookup_amd_instance()
  * Fix fgets(3) size argument (another one)
  * Fix typos in error messages
  * Remove unused local 2KB buffer
  * fix file map changed check
  * Change .requestor to .requester for consistency
  * Fix a typo in CREDITS
  * fix libtirpc detection with -Wl,--as-needed
  * Fix size arg of fgets(3)
  * Drop redundant \n in logerr()
  * Fix compiler warning in try_remount()
  * build: check for clock_gettime in librt
  * fix possible memory leak in nfs mount
  * add config option to suppress not found log message
  * properly handle errors in lookup_nss_mount
  * fix yp map age not updated during map lookup
  * fix 'nameing' typo in autofs.conf
  * add remote-fs.target systemd dependency
  * add autofs(5) note of IPv6 libtirpc requirement
  * fix autofs(5) description of supported map sources
  * fix modules make clean target
  * fix Makefile linking dependencies
  * fix handle_mounts() termination condition check
  * log pipe read errors
  * fix use-after-free in st_queue_handler()
  * always set direct mounts catatonic at exit
  * improve scalability of direct mount path component
  * fix use after free in match_my_name()
  * fix memory leak in get_network_proximity()
  * fix typo in autofs_sasl_bind()
  * fix use after free in open_lookup()
  * fix use after free in sun parser parse_init()
  * fix memory leak in ldap do_init()
  * fix memory leak in nisplus lookup_reinit()
  * fix sasl connection concurrancy problem
  * fix unbind sasl external mech
  * remove unused function elapsed()
  * change time() to use monotonic_clock()
  * change remaining gettimeofday() to use clock_gettime()
  * use monotonic clock for indirect mount condition
  * use monotonic clock for direct mount condition
  * define pending condition init helper function
  * use monotonic clock for alarm thread condition wait
  * define monotonic clock helper functions
  * Add a mode option for master map entries
  * fix error handling of is_mounted()
  * fix out of order call in program map lookup
  * add configuration option to use fqdn in mounts
  * update map_hash_table_size description
  * change lookup to use reinit instead of reopen
  * implement reinit in multi lookup module
  * fix map format check in nss_open_lookup() multi map module
  * factor out alloc multi map context
  * factor out free multi map context
  * add type to struct lookup_mod
  * implement reinit in yp lookup module
  * implement reinit in sss lookup module
  * implement reinit in program lookup module
  * implement reinit in nisplus lookup module
  * implement reinit in ldap lookup module
  * implement reinit in hosts lookup module
  * implement reinit in hesiod lookup module
  * implement reinit in file lookup module
  * implement reinit in dir lookup module
  * implement reinit in parse modules
  * add reinit entry point to modules
  * fix nsswitch handling when opening multi map
  * make open_lookup() return nss status
  * move check_nss_result() to nsswitchr.c
  * fix update_hosts_mounts() return
  * fix missing source sss in multi map lookup
  * fix direct map expire not set for initial empty map
  * fix direct mount stale instance flag reset
  * fix error handling on ldap bind fail
  * fix config old name lookup
  * fix rwlock unlock crash
  * fix return handling of do_reconnect() in ldap module
  * make find_server() return a status
  * make find_dc_server() return a status
  * make connect_to_server() return a status
  * make do_connect() return a status
  * move query dn calculation from do_bind() to do_connect()
  * fix return handling in sss lookup module
  * fix left mount count return from umount_multi_triggers()
  * revert fix libtirpc name clash
  * update libtirpc workaround for new soname
  * fix fix gcc5 complaints
  * Removed patches:
    autofs-5.1.1-task-use-after-free.patch
    autofs-improve-scalability-of-direct-mount-path-comp.patch
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch
    autofs-5.1.1-leave_auth_destroy.patch
  * Updated patches for context:
    autofs-5.1.1-dbus-udisks-monitor.patch</changelog>
  <changelog author="jeffm@suse.com" date="1502280001">- Update URL to use www.kernel.org now that ftp is gone.</changelog>
  <changelog author="jeffm@suse.com" date="1502798400">- Add gpg signature</changelog>
  <changelog author="kukuk@suse.de" date="1502798401">- Add libnsl-devel as build require in preparation of libnsl
  removal from glibc</changelog>
  <changelog author="jeffm@suse.com" date="1508328000">- fix ordering of seteuid/setegid in do_spawn (bsc#1062482).
- fix unset tsd group name handling (bsc#1062482).
- fix possible map instance memory leak (bsc#1038198).
- check map instances for staleness on map update (bsc#1038198).
- Added patches:
  - autofs-5-1-3-check-map-instances-for-staleness-on-map-update.patch
  - autofs-5-1-3-fix-ordering-of-seteuid-setegid-in-do_spawn.patch
  - autofs-5-1-3-fix-possible-map-instance-memory-leak.patch
  - autofs-5-1-3-fix-unset-tsd-group-name-handling.patch</changelog>
  <changelog author="kukuk@suse.de" date="1510488000">- Add build require for rpcgen (preparation for removing it from
  glibc)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="nfbrown@suse.com" date="1517745600">- 0001-use_hostname_for_mounts-shouldn-t-prevent-selection-.patch
  Fix handling of replicated NFS server so that
  selection between servers still works sensibly when
  use_hostname_for_mounts is in effect.
  (bsc#1066720)
- 0002-Fix-monotonic_elapsed.patch
  Fix bug introduced with monotonic-time patches which
  causes nanoseconds to be ignored and effectively
  disables sorting based on response time and/or weight.
  (bsc#1066720)</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- BuildRequire pkgconfig(udisks2) instead of udisks2-devel: let's
  be flexible on possible package name changes.
- Package COPYRIGHT as %license instead of %doc.</changelog>
  <changelog author="nfbrown@suse.com" date="1526472000">- 0003-autofs-5.1.4-fix-fd-leak-in-rpc_do_create_client.patch
  Fix filedescriptor leak (bsc#1093436)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619092800">- Update pidfile path to /run from /var/run (bsc#1185155)</changelog>
  <changelog author="nfbrown@suse.com" date="1644840000">- 0004-autofs-5.1.3-add-port-parameter-to-rpc_ping.patch
  Suppress portmap calls when port explicitly given
  (bsc#1195697)</changelog>
  <changelog author="nfbrown@suse.com" date="1647259200">- 0005-autofs-5.1.4-fix-incorrect-locking-in-sss-lookup.patch
  Fix locking problem that causes deadlock when sss used.
  (bsc#1196485)</changelog>
  <changelog author="nfbrown@suse.com" date="1647345600">- autofs-5.1.6-fix-quoted-string-length-calc-in-expand.patch
  Fix problem with quote handling
  (bsc#1181715)</changelog>
</package>
<package pkgid="177e77649f3a9678ad86c673ac467fd9cdc47c0cf598d0d65b82d36d0b66ab82" name="autofs" arch="s390x">
  <version epoch="0" ver="5.1.3" rel="150000.7.11.1"/>
  <changelog author="lchiquitto@suse.com" date="1431864000">- update to version 5.1.1:
  * fix compile error in defaults.c
  * add serialization to sasl init
  * dont allocate dev_ctl_ops too early
  * fix incorrect round robin host detection
  * fix race accessing qdn in get_query_dn()
  * fix leak in cache_push_mapent()
  * fix config entry read buffer not checked
  * fix FILE pointer check in defaults_read_config()
  * fix memory leak in conf_amd_get_log_options()
  * fix signed comparison in inet_fill_net()
  * fix buffer size checks in get_network_proximity()
  * fix leak in get_network_proximity()
  * fix buffer size checks in merge_options()
  * check amd lex buffer len before copy
  * add return check in ldap check_map_indirect()
  * check host macro is set before use
  * check options length before use in parse_amd.c
  * fix some out of order evaluations in parse_amd.c
  * fix copy and paste error in dup_defaults_entry()
  * fix leak in parse_mount()
  * add mutex call return check in defaults.c
  * force disable browse mode for amd format maps
  * fix hosts map options check in lookup_amd_instance()
  * fix memory leak in create_client()
  * fix memory leak in get_exports()
  * fix memory leak in get_defaults_entry()
  * fix out of order clearing of options buffer
  * fix reset amd lexer scan buffer
  * ignore multiple commas in options strings
  * fix typo in flagdir configure option
  * clarify multiple mounts description
  * gaurd against incorrect umount return
  * update man page autofs(8) for systemd
  * dont pass sloppy option for other than nfs mounts
  * make service want network-online
  * fix fix master map type check
  * init qdn before use in get_query_dn()
  * fix typo in update_hosts_mounts()
  * fix hosts map update on reload
  * make negative cache update consistent for all lookup modules
  * ensure negative cache isn't updated on remount
  * dont add wildcard to negative cache
  * add a prefix to program map stdvars
  * add config option to force use of program map stdvars
  * fix incorrect check in parse_mount()
  * handle duplicates in multi mounts
  * revert special case cifs escapes
  * fix map option parsing for 'strictatime'
  * fix showmount search in auto.net
  * remove obsolete comment in auto.net
  * fix macro usage in lookup_program.c
  * fix gcc5 complaints
  * remove unused offset handling code
  * fix mount as you go offset selection
  * link daemon with pthread library (Debian patch)
  * manpage corrections (Debian patch)
  * fix manpages hyphenation (Debian patch).
- ported patches:
  * autofs-5.1.0-dbus-udisks-monitor.patch -&gt;
    autofs-5.1.1-dbus-udisks-monitor.patch
  * autofs-debuginfo-fix.patch -&gt; autofs-5.1.1-debuginfo-fix.patch
  * autofs-5.0.9-suse-auto_master_default.patch -&gt;
    autofs-5.1.1-suse-auto_master_default.patch
  * autofs-5.0.9-task-use-after-free.patch -&gt;
    autofs-5.1.1-task-use-after-free.patch
- remove patches that are now upstream:
  * autofs-5.1.0-dont-pass-sloppy-option-for-other-than-nfs-mounts.patch
  * autofs-5.1.0-add-a-prefix-to-program-map-stdvars.patch
  * autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch
  * autofs-5.1.0-gcc5-fixes.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233600">- autofs.service: Use KillMode=mixed so "KillSignal" (SIGTERM) is
  only sent to the main process and if still does not exit after
  "TimeoutStopSec" then "SendSIGKILL" is sent to all remaining
  processes of the unit's control group.
  This is the desired behaviour for almost all daemons that
  execute foreign programs.</changelog>
  <changelog author="ro@suse.de" date="1449576000">- add patch autofs-5.1.1-leave_auth_destroy.patch (bnc#958410)
  do not redefined auth_destroy, the reason for this has long
  been fixed in libtirpc (version 0.2.1 is already fine)</changelog>
  <changelog author="jeffm@suse.com" date="1458820800">- improve scalability of direct mount path component creation (bsc#966573).
  * Added autofs-improve-scalability-of-direct-mount-path-comp.patch
  * Refreshed autofs-5.1.1-dbus-udisks-monitor.patch
- Use libldap_r instead of libldap for thread safety (bsc#955477).
  * Added autofs-use-libldap_r-instead-of-libldap-for-thread-safety.patch</changelog>
  <changelog author="jeffm@suse.com" date="1470830400">- Fix spurious ELOOP on certain kinds of failures (bsc#968918):
  * autofs: fix yp map age not updated in s/_/./g case
  * autofs: properly handle errors in lookup_nss_mount
  * Added patches:
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch</changelog>
  <changelog author="astieger@suse.com" date="1491480000">- remove rpmlintrc, review was boo#782691</changelog>
  <changelog author="jeffm@suse.com" date="1502280000">- update to version 5.1.3:
  * limit getgrgid_r() buffer size
  * increase worker thread per-thread stack size
  * fix offset mount location multiple expansion
  * use malloc for expanded map location
  * fix invalid reference in remount_active_mount()
  * fix work around sss startup delay
  * fix possible NULL derefernce
  * use autofs_point to store expire timeout where possibe
  * add config option to use mount request log id
  * factor out set_thread_mount_request_log_id()
  * log functions to prefix messages with attempt_id if available
  * create thread-local ID for mount attempts
  * add the mount requestor's pid to pending_args
  * delay submount exit for amd submounts
  * fix bogus check in expire_cleanup()
  * handle amd cache option all in amd type auto mounts
  * handle map_option cache for top level mounts
  * capture cache option and its settings during parsing
  * add function conf_amd_get_map_options()
  * check for conflicting amd section mounts
  * include amd mount section mounts in master mounts list
  * add function conf_amd_get_mount_paths()
  * add function conf_amd_get_map_name()
  * add support for amd browsable option
  * add ref counting to struct map_source
  * fix typos in README.amd-maps
  * honor last rw in mount options when doing a bind mount
  * set autofs mounts catatonic at exit
  * make set_direct_mount_catatonic() more general
  * check NFS server availability on local mount fallback
  * make lookup_nss_read_master() return nss status
  * don't return until after master map retry read
  * set sane default master read wait timeout
  * dont exit on master map read fail timeout
  * fix included master map not found return
  * fix quoted key handling in sanitize_path()
  * add sss master map wait config option
  * work around sss startup delay
  * add master read wait option
  * wait for master map available at start
  * update and add README for old autofs schema
  * fix create_client() RPC client handling
  * fix _strncmp() usage
  * fix argc off by one in mount_autofs.c
  * fix cachefs parse message not being logged
  * fix typo in MOUNT_FLAG_GHOST comment
  * Avoid local variable name shadowing another
  * configure: add cache variable for Linux proc filesystem check
  * fix count_mounts() function
  * fix short memory allocation in lookup_amd_instance()
  * Fix fgets(3) size argument (another one)
  * Fix typos in error messages
  * Remove unused local 2KB buffer
  * fix file map changed check
  * Change .requestor to .requester for consistency
  * Fix a typo in CREDITS
  * fix libtirpc detection with -Wl,--as-needed
  * Fix size arg of fgets(3)
  * Drop redundant \n in logerr()
  * Fix compiler warning in try_remount()
  * build: check for clock_gettime in librt
  * fix possible memory leak in nfs mount
  * add config option to suppress not found log message
  * properly handle errors in lookup_nss_mount
  * fix yp map age not updated during map lookup
  * fix 'nameing' typo in autofs.conf
  * add remote-fs.target systemd dependency
  * add autofs(5) note of IPv6 libtirpc requirement
  * fix autofs(5) description of supported map sources
  * fix modules make clean target
  * fix Makefile linking dependencies
  * fix handle_mounts() termination condition check
  * log pipe read errors
  * fix use-after-free in st_queue_handler()
  * always set direct mounts catatonic at exit
  * improve scalability of direct mount path component
  * fix use after free in match_my_name()
  * fix memory leak in get_network_proximity()
  * fix typo in autofs_sasl_bind()
  * fix use after free in open_lookup()
  * fix use after free in sun parser parse_init()
  * fix memory leak in ldap do_init()
  * fix memory leak in nisplus lookup_reinit()
  * fix sasl connection concurrancy problem
  * fix unbind sasl external mech
  * remove unused function elapsed()
  * change time() to use monotonic_clock()
  * change remaining gettimeofday() to use clock_gettime()
  * use monotonic clock for indirect mount condition
  * use monotonic clock for direct mount condition
  * define pending condition init helper function
  * use monotonic clock for alarm thread condition wait
  * define monotonic clock helper functions
  * Add a mode option for master map entries
  * fix error handling of is_mounted()
  * fix out of order call in program map lookup
  * add configuration option to use fqdn in mounts
  * update map_hash_table_size description
  * change lookup to use reinit instead of reopen
  * implement reinit in multi lookup module
  * fix map format check in nss_open_lookup() multi map module
  * factor out alloc multi map context
  * factor out free multi map context
  * add type to struct lookup_mod
  * implement reinit in yp lookup module
  * implement reinit in sss lookup module
  * implement reinit in program lookup module
  * implement reinit in nisplus lookup module
  * implement reinit in ldap lookup module
  * implement reinit in hosts lookup module
  * implement reinit in hesiod lookup module
  * implement reinit in file lookup module
  * implement reinit in dir lookup module
  * implement reinit in parse modules
  * add reinit entry point to modules
  * fix nsswitch handling when opening multi map
  * make open_lookup() return nss status
  * move check_nss_result() to nsswitchr.c
  * fix update_hosts_mounts() return
  * fix missing source sss in multi map lookup
  * fix direct map expire not set for initial empty map
  * fix direct mount stale instance flag reset
  * fix error handling on ldap bind fail
  * fix config old name lookup
  * fix rwlock unlock crash
  * fix return handling of do_reconnect() in ldap module
  * make find_server() return a status
  * make find_dc_server() return a status
  * make connect_to_server() return a status
  * make do_connect() return a status
  * move query dn calculation from do_bind() to do_connect()
  * fix return handling in sss lookup module
  * fix left mount count return from umount_multi_triggers()
  * revert fix libtirpc name clash
  * update libtirpc workaround for new soname
  * fix fix gcc5 complaints
  * Removed patches:
    autofs-5.1.1-task-use-after-free.patch
    autofs-improve-scalability-of-direct-mount-path-comp.patch
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch
    autofs-5.1.1-leave_auth_destroy.patch
  * Updated patches for context:
    autofs-5.1.1-dbus-udisks-monitor.patch</changelog>
  <changelog author="jeffm@suse.com" date="1502280001">- Update URL to use www.kernel.org now that ftp is gone.</changelog>
  <changelog author="jeffm@suse.com" date="1502798400">- Add gpg signature</changelog>
  <changelog author="kukuk@suse.de" date="1502798401">- Add libnsl-devel as build require in preparation of libnsl
  removal from glibc</changelog>
  <changelog author="jeffm@suse.com" date="1508328000">- fix ordering of seteuid/setegid in do_spawn (bsc#1062482).
- fix unset tsd group name handling (bsc#1062482).
- fix possible map instance memory leak (bsc#1038198).
- check map instances for staleness on map update (bsc#1038198).
- Added patches:
  - autofs-5-1-3-check-map-instances-for-staleness-on-map-update.patch
  - autofs-5-1-3-fix-ordering-of-seteuid-setegid-in-do_spawn.patch
  - autofs-5-1-3-fix-possible-map-instance-memory-leak.patch
  - autofs-5-1-3-fix-unset-tsd-group-name-handling.patch</changelog>
  <changelog author="kukuk@suse.de" date="1510488000">- Add build require for rpcgen (preparation for removing it from
  glibc)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="nfbrown@suse.com" date="1517745600">- 0001-use_hostname_for_mounts-shouldn-t-prevent-selection-.patch
  Fix handling of replicated NFS server so that
  selection between servers still works sensibly when
  use_hostname_for_mounts is in effect.
  (bsc#1066720)
- 0002-Fix-monotonic_elapsed.patch
  Fix bug introduced with monotonic-time patches which
  causes nanoseconds to be ignored and effectively
  disables sorting based on response time and/or weight.
  (bsc#1066720)</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- BuildRequire pkgconfig(udisks2) instead of udisks2-devel: let's
  be flexible on possible package name changes.
- Package COPYRIGHT as %license instead of %doc.</changelog>
  <changelog author="nfbrown@suse.com" date="1526472000">- 0003-autofs-5.1.4-fix-fd-leak-in-rpc_do_create_client.patch
  Fix filedescriptor leak (bsc#1093436)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619092800">- Update pidfile path to /run from /var/run (bsc#1185155)</changelog>
  <changelog author="nfbrown@suse.com" date="1644840000">- 0004-autofs-5.1.3-add-port-parameter-to-rpc_ping.patch
  Suppress portmap calls when port explicitly given
  (bsc#1195697)</changelog>
  <changelog author="nfbrown@suse.com" date="1647259200">- 0005-autofs-5.1.4-fix-incorrect-locking-in-sss-lookup.patch
  Fix locking problem that causes deadlock when sss used.
  (bsc#1196485)</changelog>
  <changelog author="nfbrown@suse.com" date="1647345600">- autofs-5.1.6-fix-quoted-string-length-calc-in-expand.patch
  Fix problem with quote handling
  (bsc#1181715)</changelog>
</package>
<package pkgid="19b61d4e77881f2e5e83d036bc5654ced24ee76c8a8f3596e279ce604af54597" name="autofs" arch="src">
  <version epoch="0" ver="5.1.3" rel="150000.7.11.1"/>
  <changelog author="lchiquitto@suse.com" date="1431864000">- update to version 5.1.1:
  * fix compile error in defaults.c
  * add serialization to sasl init
  * dont allocate dev_ctl_ops too early
  * fix incorrect round robin host detection
  * fix race accessing qdn in get_query_dn()
  * fix leak in cache_push_mapent()
  * fix config entry read buffer not checked
  * fix FILE pointer check in defaults_read_config()
  * fix memory leak in conf_amd_get_log_options()
  * fix signed comparison in inet_fill_net()
  * fix buffer size checks in get_network_proximity()
  * fix leak in get_network_proximity()
  * fix buffer size checks in merge_options()
  * check amd lex buffer len before copy
  * add return check in ldap check_map_indirect()
  * check host macro is set before use
  * check options length before use in parse_amd.c
  * fix some out of order evaluations in parse_amd.c
  * fix copy and paste error in dup_defaults_entry()
  * fix leak in parse_mount()
  * add mutex call return check in defaults.c
  * force disable browse mode for amd format maps
  * fix hosts map options check in lookup_amd_instance()
  * fix memory leak in create_client()
  * fix memory leak in get_exports()
  * fix memory leak in get_defaults_entry()
  * fix out of order clearing of options buffer
  * fix reset amd lexer scan buffer
  * ignore multiple commas in options strings
  * fix typo in flagdir configure option
  * clarify multiple mounts description
  * gaurd against incorrect umount return
  * update man page autofs(8) for systemd
  * dont pass sloppy option for other than nfs mounts
  * make service want network-online
  * fix fix master map type check
  * init qdn before use in get_query_dn()
  * fix typo in update_hosts_mounts()
  * fix hosts map update on reload
  * make negative cache update consistent for all lookup modules
  * ensure negative cache isn't updated on remount
  * dont add wildcard to negative cache
  * add a prefix to program map stdvars
  * add config option to force use of program map stdvars
  * fix incorrect check in parse_mount()
  * handle duplicates in multi mounts
  * revert special case cifs escapes
  * fix map option parsing for 'strictatime'
  * fix showmount search in auto.net
  * remove obsolete comment in auto.net
  * fix macro usage in lookup_program.c
  * fix gcc5 complaints
  * remove unused offset handling code
  * fix mount as you go offset selection
  * link daemon with pthread library (Debian patch)
  * manpage corrections (Debian patch)
  * fix manpages hyphenation (Debian patch).
- ported patches:
  * autofs-5.1.0-dbus-udisks-monitor.patch -&gt;
    autofs-5.1.1-dbus-udisks-monitor.patch
  * autofs-debuginfo-fix.patch -&gt; autofs-5.1.1-debuginfo-fix.patch
  * autofs-5.0.9-suse-auto_master_default.patch -&gt;
    autofs-5.1.1-suse-auto_master_default.patch
  * autofs-5.0.9-task-use-after-free.patch -&gt;
    autofs-5.1.1-task-use-after-free.patch
- remove patches that are now upstream:
  * autofs-5.1.0-dont-pass-sloppy-option-for-other-than-nfs-mounts.patch
  * autofs-5.1.0-add-a-prefix-to-program-map-stdvars.patch
  * autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch
  * autofs-5.1.0-gcc5-fixes.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233600">- autofs.service: Use KillMode=mixed so "KillSignal" (SIGTERM) is
  only sent to the main process and if still does not exit after
  "TimeoutStopSec" then "SendSIGKILL" is sent to all remaining
  processes of the unit's control group.
  This is the desired behaviour for almost all daemons that
  execute foreign programs.</changelog>
  <changelog author="ro@suse.de" date="1449576000">- add patch autofs-5.1.1-leave_auth_destroy.patch (bnc#958410)
  do not redefined auth_destroy, the reason for this has long
  been fixed in libtirpc (version 0.2.1 is already fine)</changelog>
  <changelog author="jeffm@suse.com" date="1458820800">- improve scalability of direct mount path component creation (bsc#966573).
  * Added autofs-improve-scalability-of-direct-mount-path-comp.patch
  * Refreshed autofs-5.1.1-dbus-udisks-monitor.patch
- Use libldap_r instead of libldap for thread safety (bsc#955477).
  * Added autofs-use-libldap_r-instead-of-libldap-for-thread-safety.patch</changelog>
  <changelog author="jeffm@suse.com" date="1470830400">- Fix spurious ELOOP on certain kinds of failures (bsc#968918):
  * autofs: fix yp map age not updated in s/_/./g case
  * autofs: properly handle errors in lookup_nss_mount
  * Added patches:
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch</changelog>
  <changelog author="astieger@suse.com" date="1491480000">- remove rpmlintrc, review was boo#782691</changelog>
  <changelog author="jeffm@suse.com" date="1502280000">- update to version 5.1.3:
  * limit getgrgid_r() buffer size
  * increase worker thread per-thread stack size
  * fix offset mount location multiple expansion
  * use malloc for expanded map location
  * fix invalid reference in remount_active_mount()
  * fix work around sss startup delay
  * fix possible NULL derefernce
  * use autofs_point to store expire timeout where possibe
  * add config option to use mount request log id
  * factor out set_thread_mount_request_log_id()
  * log functions to prefix messages with attempt_id if available
  * create thread-local ID for mount attempts
  * add the mount requestor's pid to pending_args
  * delay submount exit for amd submounts
  * fix bogus check in expire_cleanup()
  * handle amd cache option all in amd type auto mounts
  * handle map_option cache for top level mounts
  * capture cache option and its settings during parsing
  * add function conf_amd_get_map_options()
  * check for conflicting amd section mounts
  * include amd mount section mounts in master mounts list
  * add function conf_amd_get_mount_paths()
  * add function conf_amd_get_map_name()
  * add support for amd browsable option
  * add ref counting to struct map_source
  * fix typos in README.amd-maps
  * honor last rw in mount options when doing a bind mount
  * set autofs mounts catatonic at exit
  * make set_direct_mount_catatonic() more general
  * check NFS server availability on local mount fallback
  * make lookup_nss_read_master() return nss status
  * don't return until after master map retry read
  * set sane default master read wait timeout
  * dont exit on master map read fail timeout
  * fix included master map not found return
  * fix quoted key handling in sanitize_path()
  * add sss master map wait config option
  * work around sss startup delay
  * add master read wait option
  * wait for master map available at start
  * update and add README for old autofs schema
  * fix create_client() RPC client handling
  * fix _strncmp() usage
  * fix argc off by one in mount_autofs.c
  * fix cachefs parse message not being logged
  * fix typo in MOUNT_FLAG_GHOST comment
  * Avoid local variable name shadowing another
  * configure: add cache variable for Linux proc filesystem check
  * fix count_mounts() function
  * fix short memory allocation in lookup_amd_instance()
  * Fix fgets(3) size argument (another one)
  * Fix typos in error messages
  * Remove unused local 2KB buffer
  * fix file map changed check
  * Change .requestor to .requester for consistency
  * Fix a typo in CREDITS
  * fix libtirpc detection with -Wl,--as-needed
  * Fix size arg of fgets(3)
  * Drop redundant \n in logerr()
  * Fix compiler warning in try_remount()
  * build: check for clock_gettime in librt
  * fix possible memory leak in nfs mount
  * add config option to suppress not found log message
  * properly handle errors in lookup_nss_mount
  * fix yp map age not updated during map lookup
  * fix 'nameing' typo in autofs.conf
  * add remote-fs.target systemd dependency
  * add autofs(5) note of IPv6 libtirpc requirement
  * fix autofs(5) description of supported map sources
  * fix modules make clean target
  * fix Makefile linking dependencies
  * fix handle_mounts() termination condition check
  * log pipe read errors
  * fix use-after-free in st_queue_handler()
  * always set direct mounts catatonic at exit
  * improve scalability of direct mount path component
  * fix use after free in match_my_name()
  * fix memory leak in get_network_proximity()
  * fix typo in autofs_sasl_bind()
  * fix use after free in open_lookup()
  * fix use after free in sun parser parse_init()
  * fix memory leak in ldap do_init()
  * fix memory leak in nisplus lookup_reinit()
  * fix sasl connection concurrancy problem
  * fix unbind sasl external mech
  * remove unused function elapsed()
  * change time() to use monotonic_clock()
  * change remaining gettimeofday() to use clock_gettime()
  * use monotonic clock for indirect mount condition
  * use monotonic clock for direct mount condition
  * define pending condition init helper function
  * use monotonic clock for alarm thread condition wait
  * define monotonic clock helper functions
  * Add a mode option for master map entries
  * fix error handling of is_mounted()
  * fix out of order call in program map lookup
  * add configuration option to use fqdn in mounts
  * update map_hash_table_size description
  * change lookup to use reinit instead of reopen
  * implement reinit in multi lookup module
  * fix map format check in nss_open_lookup() multi map module
  * factor out alloc multi map context
  * factor out free multi map context
  * add type to struct lookup_mod
  * implement reinit in yp lookup module
  * implement reinit in sss lookup module
  * implement reinit in program lookup module
  * implement reinit in nisplus lookup module
  * implement reinit in ldap lookup module
  * implement reinit in hosts lookup module
  * implement reinit in hesiod lookup module
  * implement reinit in file lookup module
  * implement reinit in dir lookup module
  * implement reinit in parse modules
  * add reinit entry point to modules
  * fix nsswitch handling when opening multi map
  * make open_lookup() return nss status
  * move check_nss_result() to nsswitchr.c
  * fix update_hosts_mounts() return
  * fix missing source sss in multi map lookup
  * fix direct map expire not set for initial empty map
  * fix direct mount stale instance flag reset
  * fix error handling on ldap bind fail
  * fix config old name lookup
  * fix rwlock unlock crash
  * fix return handling of do_reconnect() in ldap module
  * make find_server() return a status
  * make find_dc_server() return a status
  * make connect_to_server() return a status
  * make do_connect() return a status
  * move query dn calculation from do_bind() to do_connect()
  * fix return handling in sss lookup module
  * fix left mount count return from umount_multi_triggers()
  * revert fix libtirpc name clash
  * update libtirpc workaround for new soname
  * fix fix gcc5 complaints
  * Removed patches:
    autofs-5.1.1-task-use-after-free.patch
    autofs-improve-scalability-of-direct-mount-path-comp.patch
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch
    autofs-5.1.1-leave_auth_destroy.patch
  * Updated patches for context:
    autofs-5.1.1-dbus-udisks-monitor.patch</changelog>
  <changelog author="jeffm@suse.com" date="1502280001">- Update URL to use www.kernel.org now that ftp is gone.</changelog>
  <changelog author="jeffm@suse.com" date="1502798400">- Add gpg signature</changelog>
  <changelog author="kukuk@suse.de" date="1502798401">- Add libnsl-devel as build require in preparation of libnsl
  removal from glibc</changelog>
  <changelog author="jeffm@suse.com" date="1508328000">- fix ordering of seteuid/setegid in do_spawn (bsc#1062482).
- fix unset tsd group name handling (bsc#1062482).
- fix possible map instance memory leak (bsc#1038198).
- check map instances for staleness on map update (bsc#1038198).
- Added patches:
  - autofs-5-1-3-check-map-instances-for-staleness-on-map-update.patch
  - autofs-5-1-3-fix-ordering-of-seteuid-setegid-in-do_spawn.patch
  - autofs-5-1-3-fix-possible-map-instance-memory-leak.patch
  - autofs-5-1-3-fix-unset-tsd-group-name-handling.patch</changelog>
  <changelog author="kukuk@suse.de" date="1510488000">- Add build require for rpcgen (preparation for removing it from
  glibc)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="nfbrown@suse.com" date="1517745600">- 0001-use_hostname_for_mounts-shouldn-t-prevent-selection-.patch
  Fix handling of replicated NFS server so that
  selection between servers still works sensibly when
  use_hostname_for_mounts is in effect.
  (bsc#1066720)
- 0002-Fix-monotonic_elapsed.patch
  Fix bug introduced with monotonic-time patches which
  causes nanoseconds to be ignored and effectively
  disables sorting based on response time and/or weight.
  (bsc#1066720)</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- BuildRequire pkgconfig(udisks2) instead of udisks2-devel: let's
  be flexible on possible package name changes.
- Package COPYRIGHT as %license instead of %doc.</changelog>
  <changelog author="nfbrown@suse.com" date="1526472000">- 0003-autofs-5.1.4-fix-fd-leak-in-rpc_do_create_client.patch
  Fix filedescriptor leak (bsc#1093436)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619092800">- Update pidfile path to /run from /var/run (bsc#1185155)</changelog>
  <changelog author="nfbrown@suse.com" date="1644840000">- 0004-autofs-5.1.3-add-port-parameter-to-rpc_ping.patch
  Suppress portmap calls when port explicitly given
  (bsc#1195697)</changelog>
  <changelog author="nfbrown@suse.com" date="1647259200">- 0005-autofs-5.1.4-fix-incorrect-locking-in-sss-lookup.patch
  Fix locking problem that causes deadlock when sss used.
  (bsc#1196485)</changelog>
  <changelog author="nfbrown@suse.com" date="1647345600">- autofs-5.1.6-fix-quoted-string-length-calc-in-expand.patch
  Fix problem with quote handling
  (bsc#1181715)</changelog>
</package>
<package pkgid="41b0ad7859065e11927b408c4986bc62a6ac5163cf8e6b97ae0617eade2a0a9b" name="autofs" arch="x86_64">
  <version epoch="0" ver="5.1.3" rel="150000.7.11.1"/>
  <changelog author="lchiquitto@suse.com" date="1431864000">- update to version 5.1.1:
  * fix compile error in defaults.c
  * add serialization to sasl init
  * dont allocate dev_ctl_ops too early
  * fix incorrect round robin host detection
  * fix race accessing qdn in get_query_dn()
  * fix leak in cache_push_mapent()
  * fix config entry read buffer not checked
  * fix FILE pointer check in defaults_read_config()
  * fix memory leak in conf_amd_get_log_options()
  * fix signed comparison in inet_fill_net()
  * fix buffer size checks in get_network_proximity()
  * fix leak in get_network_proximity()
  * fix buffer size checks in merge_options()
  * check amd lex buffer len before copy
  * add return check in ldap check_map_indirect()
  * check host macro is set before use
  * check options length before use in parse_amd.c
  * fix some out of order evaluations in parse_amd.c
  * fix copy and paste error in dup_defaults_entry()
  * fix leak in parse_mount()
  * add mutex call return check in defaults.c
  * force disable browse mode for amd format maps
  * fix hosts map options check in lookup_amd_instance()
  * fix memory leak in create_client()
  * fix memory leak in get_exports()
  * fix memory leak in get_defaults_entry()
  * fix out of order clearing of options buffer
  * fix reset amd lexer scan buffer
  * ignore multiple commas in options strings
  * fix typo in flagdir configure option
  * clarify multiple mounts description
  * gaurd against incorrect umount return
  * update man page autofs(8) for systemd
  * dont pass sloppy option for other than nfs mounts
  * make service want network-online
  * fix fix master map type check
  * init qdn before use in get_query_dn()
  * fix typo in update_hosts_mounts()
  * fix hosts map update on reload
  * make negative cache update consistent for all lookup modules
  * ensure negative cache isn't updated on remount
  * dont add wildcard to negative cache
  * add a prefix to program map stdvars
  * add config option to force use of program map stdvars
  * fix incorrect check in parse_mount()
  * handle duplicates in multi mounts
  * revert special case cifs escapes
  * fix map option parsing for 'strictatime'
  * fix showmount search in auto.net
  * remove obsolete comment in auto.net
  * fix macro usage in lookup_program.c
  * fix gcc5 complaints
  * remove unused offset handling code
  * fix mount as you go offset selection
  * link daemon with pthread library (Debian patch)
  * manpage corrections (Debian patch)
  * fix manpages hyphenation (Debian patch).
- ported patches:
  * autofs-5.1.0-dbus-udisks-monitor.patch -&gt;
    autofs-5.1.1-dbus-udisks-monitor.patch
  * autofs-debuginfo-fix.patch -&gt; autofs-5.1.1-debuginfo-fix.patch
  * autofs-5.0.9-suse-auto_master_default.patch -&gt;
    autofs-5.1.1-suse-auto_master_default.patch
  * autofs-5.0.9-task-use-after-free.patch -&gt;
    autofs-5.1.1-task-use-after-free.patch
- remove patches that are now upstream:
  * autofs-5.1.0-dont-pass-sloppy-option-for-other-than-nfs-mounts.patch
  * autofs-5.1.0-add-a-prefix-to-program-map-stdvars.patch
  * autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch
  * autofs-5.1.0-gcc5-fixes.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233600">- autofs.service: Use KillMode=mixed so "KillSignal" (SIGTERM) is
  only sent to the main process and if still does not exit after
  "TimeoutStopSec" then "SendSIGKILL" is sent to all remaining
  processes of the unit's control group.
  This is the desired behaviour for almost all daemons that
  execute foreign programs.</changelog>
  <changelog author="ro@suse.de" date="1449576000">- add patch autofs-5.1.1-leave_auth_destroy.patch (bnc#958410)
  do not redefined auth_destroy, the reason for this has long
  been fixed in libtirpc (version 0.2.1 is already fine)</changelog>
  <changelog author="jeffm@suse.com" date="1458820800">- improve scalability of direct mount path component creation (bsc#966573).
  * Added autofs-improve-scalability-of-direct-mount-path-comp.patch
  * Refreshed autofs-5.1.1-dbus-udisks-monitor.patch
- Use libldap_r instead of libldap for thread safety (bsc#955477).
  * Added autofs-use-libldap_r-instead-of-libldap-for-thread-safety.patch</changelog>
  <changelog author="jeffm@suse.com" date="1470830400">- Fix spurious ELOOP on certain kinds of failures (bsc#968918):
  * autofs: fix yp map age not updated in s/_/./g case
  * autofs: properly handle errors in lookup_nss_mount
  * Added patches:
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch</changelog>
  <changelog author="astieger@suse.com" date="1491480000">- remove rpmlintrc, review was boo#782691</changelog>
  <changelog author="jeffm@suse.com" date="1502280000">- update to version 5.1.3:
  * limit getgrgid_r() buffer size
  * increase worker thread per-thread stack size
  * fix offset mount location multiple expansion
  * use malloc for expanded map location
  * fix invalid reference in remount_active_mount()
  * fix work around sss startup delay
  * fix possible NULL derefernce
  * use autofs_point to store expire timeout where possibe
  * add config option to use mount request log id
  * factor out set_thread_mount_request_log_id()
  * log functions to prefix messages with attempt_id if available
  * create thread-local ID for mount attempts
  * add the mount requestor's pid to pending_args
  * delay submount exit for amd submounts
  * fix bogus check in expire_cleanup()
  * handle amd cache option all in amd type auto mounts
  * handle map_option cache for top level mounts
  * capture cache option and its settings during parsing
  * add function conf_amd_get_map_options()
  * check for conflicting amd section mounts
  * include amd mount section mounts in master mounts list
  * add function conf_amd_get_mount_paths()
  * add function conf_amd_get_map_name()
  * add support for amd browsable option
  * add ref counting to struct map_source
  * fix typos in README.amd-maps
  * honor last rw in mount options when doing a bind mount
  * set autofs mounts catatonic at exit
  * make set_direct_mount_catatonic() more general
  * check NFS server availability on local mount fallback
  * make lookup_nss_read_master() return nss status
  * don't return until after master map retry read
  * set sane default master read wait timeout
  * dont exit on master map read fail timeout
  * fix included master map not found return
  * fix quoted key handling in sanitize_path()
  * add sss master map wait config option
  * work around sss startup delay
  * add master read wait option
  * wait for master map available at start
  * update and add README for old autofs schema
  * fix create_client() RPC client handling
  * fix _strncmp() usage
  * fix argc off by one in mount_autofs.c
  * fix cachefs parse message not being logged
  * fix typo in MOUNT_FLAG_GHOST comment
  * Avoid local variable name shadowing another
  * configure: add cache variable for Linux proc filesystem check
  * fix count_mounts() function
  * fix short memory allocation in lookup_amd_instance()
  * Fix fgets(3) size argument (another one)
  * Fix typos in error messages
  * Remove unused local 2KB buffer
  * fix file map changed check
  * Change .requestor to .requester for consistency
  * Fix a typo in CREDITS
  * fix libtirpc detection with -Wl,--as-needed
  * Fix size arg of fgets(3)
  * Drop redundant \n in logerr()
  * Fix compiler warning in try_remount()
  * build: check for clock_gettime in librt
  * fix possible memory leak in nfs mount
  * add config option to suppress not found log message
  * properly handle errors in lookup_nss_mount
  * fix yp map age not updated during map lookup
  * fix 'nameing' typo in autofs.conf
  * add remote-fs.target systemd dependency
  * add autofs(5) note of IPv6 libtirpc requirement
  * fix autofs(5) description of supported map sources
  * fix modules make clean target
  * fix Makefile linking dependencies
  * fix handle_mounts() termination condition check
  * log pipe read errors
  * fix use-after-free in st_queue_handler()
  * always set direct mounts catatonic at exit
  * improve scalability of direct mount path component
  * fix use after free in match_my_name()
  * fix memory leak in get_network_proximity()
  * fix typo in autofs_sasl_bind()
  * fix use after free in open_lookup()
  * fix use after free in sun parser parse_init()
  * fix memory leak in ldap do_init()
  * fix memory leak in nisplus lookup_reinit()
  * fix sasl connection concurrancy problem
  * fix unbind sasl external mech
  * remove unused function elapsed()
  * change time() to use monotonic_clock()
  * change remaining gettimeofday() to use clock_gettime()
  * use monotonic clock for indirect mount condition
  * use monotonic clock for direct mount condition
  * define pending condition init helper function
  * use monotonic clock for alarm thread condition wait
  * define monotonic clock helper functions
  * Add a mode option for master map entries
  * fix error handling of is_mounted()
  * fix out of order call in program map lookup
  * add configuration option to use fqdn in mounts
  * update map_hash_table_size description
  * change lookup to use reinit instead of reopen
  * implement reinit in multi lookup module
  * fix map format check in nss_open_lookup() multi map module
  * factor out alloc multi map context
  * factor out free multi map context
  * add type to struct lookup_mod
  * implement reinit in yp lookup module
  * implement reinit in sss lookup module
  * implement reinit in program lookup module
  * implement reinit in nisplus lookup module
  * implement reinit in ldap lookup module
  * implement reinit in hosts lookup module
  * implement reinit in hesiod lookup module
  * implement reinit in file lookup module
  * implement reinit in dir lookup module
  * implement reinit in parse modules
  * add reinit entry point to modules
  * fix nsswitch handling when opening multi map
  * make open_lookup() return nss status
  * move check_nss_result() to nsswitchr.c
  * fix update_hosts_mounts() return
  * fix missing source sss in multi map lookup
  * fix direct map expire not set for initial empty map
  * fix direct mount stale instance flag reset
  * fix error handling on ldap bind fail
  * fix config old name lookup
  * fix rwlock unlock crash
  * fix return handling of do_reconnect() in ldap module
  * make find_server() return a status
  * make find_dc_server() return a status
  * make connect_to_server() return a status
  * make do_connect() return a status
  * move query dn calculation from do_bind() to do_connect()
  * fix return handling in sss lookup module
  * fix left mount count return from umount_multi_triggers()
  * revert fix libtirpc name clash
  * update libtirpc workaround for new soname
  * fix fix gcc5 complaints
  * Removed patches:
    autofs-5.1.1-task-use-after-free.patch
    autofs-improve-scalability-of-direct-mount-path-comp.patch
    autofs-5.1.1-properly-handle-errors-in-lookup_nss_mount.patch
    autofs-5.1.1-fix-yp-map-age-not-updated-during-map-lookup.patch
    autofs-5.1.1-leave_auth_destroy.patch
  * Updated patches for context:
    autofs-5.1.1-dbus-udisks-monitor.patch</changelog>
  <changelog author="jeffm@suse.com" date="1502280001">- Update URL to use www.kernel.org now that ftp is gone.</changelog>
  <changelog author="jeffm@suse.com" date="1502798400">- Add gpg signature</changelog>
  <changelog author="kukuk@suse.de" date="1502798401">- Add libnsl-devel as build require in preparation of libnsl
  removal from glibc</changelog>
  <changelog author="jeffm@suse.com" date="1508328000">- fix ordering of seteuid/setegid in do_spawn (bsc#1062482).
- fix unset tsd group name handling (bsc#1062482).
- fix possible map instance memory leak (bsc#1038198).
- check map instances for staleness on map update (bsc#1038198).
- Added patches:
  - autofs-5-1-3-check-map-instances-for-staleness-on-map-update.patch
  - autofs-5-1-3-fix-ordering-of-seteuid-setegid-in-do_spawn.patch
  - autofs-5-1-3-fix-possible-map-instance-memory-leak.patch
  - autofs-5-1-3-fix-unset-tsd-group-name-handling.patch</changelog>
  <changelog author="kukuk@suse.de" date="1510488000">- Add build require for rpcgen (preparation for removing it from
  glibc)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="nfbrown@suse.com" date="1517745600">- 0001-use_hostname_for_mounts-shouldn-t-prevent-selection-.patch
  Fix handling of replicated NFS server so that
  selection between servers still works sensibly when
  use_hostname_for_mounts is in effect.
  (bsc#1066720)
- 0002-Fix-monotonic_elapsed.patch
  Fix bug introduced with monotonic-time patches which
  causes nanoseconds to be ignored and effectively
  disables sorting based on response time and/or weight.
  (bsc#1066720)</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- BuildRequire pkgconfig(udisks2) instead of udisks2-devel: let's
  be flexible on possible package name changes.
- Package COPYRIGHT as %license instead of %doc.</changelog>
  <changelog author="nfbrown@suse.com" date="1526472000">- 0003-autofs-5.1.4-fix-fd-leak-in-rpc_do_create_client.patch
  Fix filedescriptor leak (bsc#1093436)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619092800">- Update pidfile path to /run from /var/run (bsc#1185155)</changelog>
  <changelog author="nfbrown@suse.com" date="1644840000">- 0004-autofs-5.1.3-add-port-parameter-to-rpc_ping.patch
  Suppress portmap calls when port explicitly given
  (bsc#1195697)</changelog>
  <changelog author="nfbrown@suse.com" date="1647259200">- 0005-autofs-5.1.4-fix-incorrect-locking-in-sss-lookup.patch
  Fix locking problem that causes deadlock when sss used.
  (bsc#1196485)</changelog>
  <changelog author="nfbrown@suse.com" date="1647345600">- autofs-5.1.6-fix-quoted-string-length-calc-in-expand.patch
  Fix problem with quote handling
  (bsc#1181715)</changelog>
</package>
<package pkgid="3e39e886a75cc8f4b31ad3dd21c661d70b2c2d5d898d97a5b01b808933e09d4e" name="autogen" arch="aarch64">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="21f5c9907f7fabda5adee8102a534fe7862655a612523c3d2b7e9db9742a6b10" name="autogen" arch="ppc64le">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="8ab9015af21c86adc8730083b20e8dbc85bf70754cfccfd467dfd939e48e3d57" name="autogen" arch="s390x">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="68972e88a0307f72f1c92a833a4b474b153b789310dc472ca9010b3e5abb5724" name="autogen" arch="src">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1337688000">- Update to version 5.16
  * Changes, many see http://autogen.sourceforge.net/announce.html.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1342267200">- Fix source URL, this update must reach 12.2 because
  autogen was generating broken C code that segfaults
  with fortify source.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1362225600">- fix build with automake-1.13.1
- add explicit makeinfo buildrequires, it is required to build</changelog>
  <changelog author="pth@suse.de" date="1366113600">- Update to 5.16.2:
  * Coverity cleanups
  * evade Guile issue on BSD platform.
  * avoid emitting non-error messages to stderr
- Adapt autogen-build_ldpath.patch to the changed sources.</changelog>
  <changelog author="schwab@suse.de" date="1404388800">- Update to 5.18.3
  * ATTRIBUTE_FORMAT_ARG is a configured attribute that wraps
    __attribute__((__format_arg__(n))) procedure declaration attributes.
    To configure it, the ag_macros.m4 has a new macroo,
    AG_COMPILE_FORMAT_ARG (which is a compile only test probe).
  * Auto-edit Guile headers that depend upon configure values
    most especially:  noreturn
    but check for "ptrdiff_t" in our configure too, so that Guile does
    not create its own duplicate definition.
  * Abort from the failing function so that stack traces are useful
  * The libopts m4 configure code must configure the libopts/Makefile
  * Happy 2014 New Year
  * make sure library option handling code does nothing when the
    library is just trying to get information about an option.
  * Only apply texi2mdoc when it is needed.
  * The aoGetsText() emitted i18n helper function needs its argument
    to have the "format_arg" attribute.
  * documentation clarifications
  * properly create generated main procedures from user supplied code.
  * ChangeLog files have been removed from GIT sources
    (though still obtainable with tagged checkouts).
  * LIBGUILE_PATH is not needed and its derivation is wrong on
    where binaries and libraries have different prefixes.
  * fixed char casting issue that shows in UTF-8 files
  * fixed installation error for str2init
  * fixed failure handling in the usage template
  * fix broken flag values for auto-supported options
  * various tweaks to make Coverity happy.
  * allow the fatal error message functions to be tagged "noreturn"
    and incorporate sysnoreturn.h technology into AutoGen.
  * --save-opts documentation cleanup
  * optionMemberList() will return an allocated string containing
    the names of the bits set in the option.
  * tab stripped "here strings" include stripping the backslash
    escape character when it precedes any whitespace character.
- autoopts-remove-stupid-set-e.patch: remove stupid use of set -e
- autogen-setfilename.patch: remove
- autogen-build_ldpath.patch: regenerate
- run testsuite</changelog>
  <changelog author="schwab@suse.de" date="1404475200">- agen5-testsuite.patch: fix spurious testsuite failure</changelog>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="12a4adfed808c4fe2a1280253c42b61e56a68c8350ef8cdc3db002925d692f95" name="autogen" arch="x86_64">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="7a12d698df3c894db7bcff93ef107696f3a11d48c194653c6d89b62134486aa5" name="automake" arch="noarch">
  <version epoch="0" ver="1.15.1" rel="4.10.2"/>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
</package>
<package pkgid="b327555c22086e0cc7ef7b57095b5f7391f506f7477188a34f99c5891c5b2be9" name="automake" arch="src">
  <version epoch="0" ver="1.15.1" rel="4.10.2"/>
  <changelog author="pth@suse.de" date="1369656000">- Update to 1.13.2 (for the full change log please see the file NEWS
  in the package documentation):
  * Obsolescent features:
  - Use of suffix-less info files (that can be specified through the
    '@setfilename' macro in Texinfo input files) is discouraged, and
    its use will raise warnings in the 'obsolete' category.
  - Use of Texinfo input files with '.txi' or '.texinfo' extensions
    is discouraged, and its use will raise warnings in the 'obsolete'
    category.  You are advised to simply use the '.texi' extension
    instead.
  * Documentation fixes:
  - The long-deprecated but still supported two-arguments invocation form
    of AM_INIT_AUTOMAKE is documented once again.
  * Bugs fixed:
  - When the 'ustar' option is used, the generated configure script no
    longer risks hanging during the tests for the availability of the
    'pax' utility, even if the user running configure has a UID or GID
    that requires more than 21 bits to be represented.
  - The obsolete macros AM_CONFIG_HEADER or AM_PROG_CC_STDC work once
    again, as they did in Automake 1.12.x (albeit printing runtime
    warnings in the 'obsolete' category).
  - aclocal will no longer error out if the first local m4 directory
    (as specified by the '-I' option or the 'AC_CONFIG_MACRO_DIRS' or
    'AC_CONFIG_MACRO_DIR' macros) doesn't exist; it will merely report
    a warning in the 'unsupported' category.
  - aclocal will no longer consider directories for extra m4 files more
    than once, even if they are specified multiple times.
  - Analysis of make flags in Automake-generated rules has been made more
    robust, and more future-proof.
- Adapt automake-SUSE.patch to the changed sources.</changelog>
  <changelog author="pth@suse.de" date="1369742400">- Remove aclocal-am_ac.patch and aclocal-am_ac.sh as they aren't
  needed anymore and instead cause havok.</changelog>
  <changelog author="pth@suse.de" date="1371038400">- Update to 1.13.3:
  * Documentation fixes:
  - The documentation no longer mistakenly reports that the
    obsolete 'AM_MKDIR_PROG_P' macro and '$(mkdir_p)' make variable
    are going to be removed in Automake 2.0.
  * Bugs fixed:
  - Byte-compilation of Emacs lisp files could fail spuriously on
    Solaris, when /bin/ksh or /usr/xpg4/bin/sh were used as shell.
  - If the same user-defined suffixes were transformed into
    different Automake-known suffixes in different Makefile.am
    files in the same project, automake could get confused and
    generate inconsistent Makefiles (automake bug#14441).
    For example, if 'Makefile.am' contained a ".ext.cc:" suffix
    rule, and 'sub/Makefile.am' contained a ".ext.c:" suffix rule,
    automake would have mistakenly placed into 'Makefile.in' rules
    to compile "*.c" files into object files, and into
    'sub/Makefile.in' rules to compile "*.cc" files into object
    files --- rather than the other way around.  This is now fixed.
  - Several spurious failures have been fixed (they hit especially
    MinGW/MSYS builds).  See automake bugs #14493, #14494, #14495,
    [#14498], #14499, #14500, #14501, #14517 and #14528.
  - Some other minor miscellaneous changes and fixlets.
  - Patches updated to they apply cleanly and with no offset.</changelog>
  <changelog author="pth@suse.de" date="1371470400">- Update to 1.13.4:
  - Fix a minor regression introduced in Automake 1.13.3: when two or more
    user-defined suffix rules were present in a single Makefile.am,
    automake would needlessly include definition of some make variables
    related to C compilation in the generated Makefile.in (bug#14560).
- Adapt automake-SuSE.patch to changed config.guess.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1376654400">- fix tests on factory
  automake-1.13.4-fix-primary-prefix-invalid-couples-test.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1383048000">- Add expect as BuildRequires/Requires for automake-testsuite.</changelog>
  <changelog author="jengelh@inai.de" date="1391601600">- Update to new upstream release 1.14.1
  * The 'compile' script is now unconditionally required for all
  packages that perform C compilation
  * The AM_PROG_CC_C_O macro can still be called, albeit that
  should no longer be necessary.
  * The special Automake-time substitutions '%reldir%' and
  '%canon_reldir%' (and their short versions, '%D%' and '%C%'
  respectively) can now be used in an included Makefile fragment.
  The former is substituted with the relative directory of the
  included fragment (compared to the top-level including
  Makefile), and the latter with the canonicalized version of the
  same relative directory.
  * The 'shar' and 'compress' distribution formats are deprecated</changelog>
  <changelog author="pth@suse.de" date="1408968000">- Explicitely pass the directory name to setup so that the testsuite
  can run.</changelog>
  <changelog author="gber@opensuse.org" date="1412596800">- Add automake-fix-ac_aux_dir-used-before-initialized.patch in
  to fix the use of $ac_aux_dir before being initialized</changelog>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
</package>
<package pkgid="a81cb49b9d43b61e8e1a8d14fe847f25f4dd8d48f6819c89b93bd342ed9a07ab" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.100" rel="150300.3.42.1"/>
  <changelog author="kanderssen@suse.com" date="1620907200">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
</package>
<package pkgid="49437310d3faee238111db3ebf3e94120f0a8ef06ed3c0dd96529849fbf6248f" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.100" rel="150300.3.42.1"/>
  <changelog author="kanderssen@suse.com" date="1620907200">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
</package>
<package pkgid="4fc72897027ac5ab4317c8ae88fe3d71ff445092406ee93919a2e16e2e6c5de6" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.102" rel="150300.3.47.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
</package>
<package pkgid="bef56286421596796c5f82113387e57dd8366971456ba9334aef20397e05cabb" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.102" rel="150300.3.47.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
</package>
<package pkgid="235b615d40b6e93fb15a59c7929344df6f630e6b327d44ea3dca88b47c16475f" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.104" rel="150300.3.52.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
  <changelog author="kanderssen@suse.com" date="1658491200">- Revert the modification done in version 4.3.97 running the
  initscripts before systed-user-sessions service again once
  systemd fixed logind (bsc#1195059, bsc#1200780)
- 4.3.103</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1664280000">- Process the &lt;ask-list/&gt; section in an installed system once the
  &lt;general/&gt; section is imported in the (bsc#1201953).
- 4.3.104</changelog>
</package>
<package pkgid="669deedd683302170a5d36c78e6306421244f6ebda56c02d28c7f414bba509da" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.104" rel="150300.3.52.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
  <changelog author="kanderssen@suse.com" date="1658491200">- Revert the modification done in version 4.3.97 running the
  initscripts before systed-user-sessions service again once
  systemd fixed logind (bsc#1195059, bsc#1200780)
- 4.3.103</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1664280000">- Process the &lt;ask-list/&gt; section in an installed system once the
  &lt;general/&gt; section is imported in the (bsc#1201953).
- 4.3.104</changelog>
</package>
<package pkgid="dd0ca50d4d5ff319d1ed84dbd72b9460fc4d59f0763d37e4949818f0ebeacc7f" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="ae294d1705fcc10d970fcc22edff36fd54a4d12fcf1dad1d4fd98516c37ce0ac" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="f58139b18fb1967fc6f0c2392f657833736eb01abbaeb5cf019e5a214b3148d6" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="8f89995f1ed68e7504f3aa837bd1f1fe132982711fcd6ebe7b0a734f711409c6" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="6eb474f0d3a12390f67a82871997c10959588502bda7f77052a905a33cfe808d" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="3c43b3c3bdee50d8fe85c668fa86319e96ba95478f9fc29966067f72e42fccb0" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="e7d1e35e1941b0c722b0b456df453f55ce498665b3d0405df4941d83b3aa7031" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="54f3e3d79c28724541122e809c33f15cf2f1e7ad58859c9befcc61b9a5e24597" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="1953d999902ea796d8076d727a6b1eca54e004f56012ea7ec1ec52f7a809f302" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.94" rel="3.32.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
</package>
<package pkgid="1f7c592a273d786ca143df06cfe68e4a138036cf1960dca60bc6269dc63821ad" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.94" rel="3.32.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
</package>
<package pkgid="21496b568f4d307e04ee47cf50e09f2d077aa12625cc8a5c25869b315afefeb5" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.96" rel="150300.3.35.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
</package>
<package pkgid="5b5356a90ff0deea31307a0af1063a31e35fb2495c7c601c002cc8ef6034ef9a" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.96" rel="150300.3.35.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
</package>
<package pkgid="c80218802c57f8a9e44d2cca8ad2616a9ef5aea8110346af0184dce0b3a8eb6c" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.100" rel="150300.3.42.1"/>
  <changelog author="kanderssen@suse.com" date="1620907200">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
</package>
<package pkgid="314b22b17b9be900d5912d53ae784691c680bc316cfab0f7dc52b939e4f23fa9" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.102" rel="150300.3.47.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
</package>
<package pkgid="061aefe0b9f126abf68bcb2bb834c35950db54b2555f9949b8c895df5f2840fc" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.104" rel="150300.3.52.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
  <changelog author="kanderssen@suse.com" date="1645444800">- Modified init-scripts service dependencies fixing a root login
  systemd timeout when installing with ssh (bsc#1195059)
- 4.3.97</changelog>
  <changelog author="snwint@suse.com" date="1645617600">- add yast namespace to merge.xslt to fix CDATA handling (bsc#1195910)
- 4.3.98</changelog>
  <changelog author="jlopez@suse.com" date="1646136000">- Avoid login while running AutoYaST init-scripts (bsc#1196594 and
  related to bsc#1195059).
- 4.3.99</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1646308800">- Properly handle the "dopackages" option in the openFile
  method of the AyastSetup module (bsc#1196566).
- 4.3.100</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1648814400">- Respect general/signature-handling settings during the 2nd
  stage (bsc#1197655).
- 4.3.101</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1651579200">- Fix detection disk serial and size in the "disks" ERB helper
  (bsc#1199000).
- Fix rules validation when using a dialog (bsc#1199165).
- 4.3.102</changelog>
  <changelog author="kanderssen@suse.com" date="1658491200">- Revert the modification done in version 4.3.97 running the
  initscripts before systed-user-sessions service again once
  systemd fixed logind (bsc#1195059, bsc#1200780)
- 4.3.103</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1664280000">- Process the &lt;ask-list/&gt; section in an installed system once the
  &lt;general/&gt; section is imported in the (bsc#1201953).
- 4.3.104</changelog>
</package>
<package pkgid="2508fe04c41d03a36c9bd5dc145abf94982ed8889e5646a3a385fe08e7ee3215" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="ba9680c8154f63e177b056126b65e7228137ccb6614e56ef393f52869c1e3d7a" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="156e8bfc035662ce2748e3eb24dcf05586b31191666f96289e94dfd72c29ef47" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="b6e2a64196c4f0dc357d32eb49b35ccb0fb79f62c85c002a03cde53590573365" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="2332f397783abd352c5920138e1a1e696cd3002bf0ea4682b1b03ec6d88c6dbe" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.94" rel="3.32.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
</package>
<package pkgid="7d6c093876e9daf21a86037580314f93d2962189fa556287bd62c4168f724f0a" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.96" rel="150300.3.35.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
  <changelog author="jreidinger@suse.com" date="1635768000">- Stop autoyast installation when registration failed on online
  medium (bsc#1188211)
- 4.3.92</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1637236800">- Do not process the &lt;add-on/&gt; section during the 2nd stage
  (bsc#1192185).
- 4.3.93</changelog>
  <changelog author="kanderssen@suse.com" date="1637841600">- During autoupgrade merge the selected product workflow in order
  to execute 2nd stage modules (bsc#1192437)
- 4.3.94</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642075200">- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1642680000">- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96</changelog>
</package>
<package pkgid="7d7c57930c7877ca61c4f93be43230e9b774cf55f0e6d88e8d2c2b86a37c9e66" name="avahi" arch="src">
  <version epoch="0" ver="0.6.32" rel="5.13.1"/>
  <changelog author="dmueller@suse.com" date="1398513600">- Do not depend on gnome-icon-theme:
  + the network-wired icon is meanwhile available in faenza, gnome,
    mate, nimbus oxygen and tango icon theme.
  + the dependency causes avahi depending on gtk3, which causes a
    build loop with gtk2.
  + the avahi-desktop.patch causes these desktop files to be only
    shown in GTK based desktops, which have any of those icon
    themes available.</changelog>
  <changelog author="dimstar@opensuse.org" date="1421928000">- Add avahi-outdated-URL.patch: Do not redirect users to
  &lt;http://0pointer.de/avahi-compat?s=libdns_sd&amp;e=ntpd&gt;, which no
  longer exists, but bring them to the more generic blog entry
  http://0pointer.de/blog/projects/avahi-compat.html (boo#914298).</changelog>
  <changelog author="dimstar@opensuse.org" date="1439985600">- Sync up the multiple .spec files.</changelog>
  <changelog author="mgorse@suse.com" date="1444305600">- Add avahi-0.6.31-invalid-packet.patch: do not spam logs for
  invalid packets (boo#947140 bsc#948277).</changelog>
  <changelog author="zaitor@opensuse.org" date="1445256000">- Temp disable 2 old Conflicts that are breaking staging. These can
  back in once there is a new release of avahi.</changelog>
  <changelog author="dimstar@opensuse.org" date="1453723200">- No longer install sysv services: the systemd services have been
  installed for a long time already and are masking the sysv
  scripts; those scripts existance only add confusion (boo#959908).</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="alarrosa@suse.com" date="1463745600">- Update to GNOME 3.20.2 (Fate#318572)
- Added License field in spec file.</changelog>
  <changelog author="mgorse@suse.com" date="1466683200">- Add avahi-0.6.31-systemd-order.patch: start after NM/wicked, to
  ensure resolv.conf is present (bsc#982317, gh#lathiat/avahi#59).</changelog>
  <changelog author="dimstar@opensuse.org" date="1466683201">- Update to version 0.6.32:
  + Don't log warnings about invalid packets, commonly triggered by
    Windows 10 systems.
  + Fix issue with bad packet size estimation, causing probes to
    continuously be sent when hosting large numbers of services.
  + Fix build on Solaris/SmartOS (filio.h issue).
  + Fix build on FreeBSD (PCAP_D_IN issue).
  + Fix debug output with libdaemon &gt;= 0.14.
  + avahi_server_set_browse_domains now correctly uses the provided
    list, instead of re-using the list from the configuration file.
  + Set nl_pid to 0, this will automatically assign the value and
    prevent conflicts per netlink(7). (Bug #334).
  + Check for netlink pid=0 (kernel) instead of uid=0, which works
    correctly with network &amp; user namespaces.
  + Fix reversed IFA_LOCAL and IFA_ADDRESS checks (Avahi#355).
  + Don't fail the build on deprecated GTK/GLIB usage.
  + Gracefully fail if SO_REUSEPORT is not available.
  + Minor Python 3 update for the python ServiceTypeDatabase test
    usage of print, should be backwards compatible.
  + avahi-autoipd: Fix incorrect usage of IFLA_RTA instead of
    IFA_RTA which could crash on ARM (Closes: gh#lathiat/avahi#42).
- Drop upstream fixed patches:
  + avahi-unicastdomains.patch
  + avahi-gtk_box_new.patch
  + avahi-fix-mkdir.diff
  + avahi-enable-ipv6.patch
  + avahi-reserve-space-for-record-data-when-size-e.patch
- Rebase avahi-0.6.31-invalid-packet.patch.</changelog>
  <changelog author="mgorse@suse.com" date="1468238400">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-0.6.32-suppress-resolv-conf-warning.patch: only warn
  on missing resolv.conf if the options that use it are enabled.
  https://github.com/lathiat/avahi/pull/63</changelog>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1547467200">- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
</package>
<package pkgid="3f8d6ec4e48152f7efbf6a716b5edfdacf1634c1a99ee939d39ec92f32ea7ca1" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="c11dd6e523aeed794f723a707b3d46d23d5ce248318dab191480126ff42a1a2a" name="avahi" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="7f716d2752c276b21326cdc4a4c5999986bf14c9997b5772adeed45b61b74660" name="avahi" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="40c8a7e25f54a5a3def66045e2fbb5f726e5c772c175c121531ec54c3425e6fb" name="avahi" arch="src">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="92e7271e4d6996f4f353857e3bbd1527de38be4308976b86831b502a5c74371d" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="2d4b91c67e4e2dddeebf2ad8c56d9019d974543130d3d5db790b1b39bcbe01b8" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="25b2019eabffd91b3751c8b6a0005c011c03a92e9a31e404ce9d5cec4cbfdf00" name="avahi" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="0fe32b32733234208e88cf3b68fe959c7e802713c02c5c31a8c188408b68472f" name="avahi" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="7c9ff80f724054e3051211beb48e98755ee0d94603e9294eb7be1cd772e1551b" name="avahi" arch="src">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="e1b2be8ed0f04a64397c18d38c6dfb3bb0c2f7df6832e365bf3140a336e90d43" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="42debefa7fa3be61f517b6ac5d91a18431d67194a99179ca92932ba777212b0d" name="avahi-autoipd" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="0df2176d38fdef96811706e4d677e7a4c78ee65a60ff0d7d216b72d79be7123c" name="avahi-autoipd" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="e2c3677f605f03bb7bfbea3bf3122cc23d24d2b4ac0f4972cd9a710ed087fc8c" name="avahi-autoipd" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="ad3b2cdb1cc5527d30c6ffb66ace6953f84ab2c07fbd81998bb7201767726fab" name="avahi-autoipd" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="6c6ed47b283a7bf5264b72f88c9751a81e10abf0b2f78db8f46ccc031c1bd4fc" name="avahi-autoipd" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="84d576384d00cdb6a09da288ad11dfcc2463a117f227c2455430b325019296fe" name="avahi-autoipd" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="d2884485be3ed2a2408681215c4b7bb396df9d6dbb5d3d640d74fc4a1af43946" name="avahi-autoipd" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="fd57d55a75d3d58b9aa617bfa5011aa66f7217c67fda117d41cccfa2b5bf6b24" name="avahi-autoipd" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="b2b2070d402f68c69dec079a1d3d01ea0963ef33eb99a32c1952a0c91c5c9c81" name="avahi-compat-howl-devel" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="c29fafa0437178c714d13b507d9fe37fd1d86fd0546dd62634b3392f5fdb7a70" name="avahi-compat-howl-devel" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="3275877553844027b30918072cf60447c0ba2afbe6229983b431dcba17e41d01" name="avahi-compat-howl-devel" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="af8e7c0205b74ef7bd293335a7351c5bc711182fc3283d01ed46730e660ba752" name="avahi-compat-howl-devel" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="3f4ef6d8b2f7b9ee70cec3292b98feea16a035c64fee2b4b0ebc41e0ed8d9c1c" name="avahi-compat-howl-devel" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="4609bca734736fe7ce7b5d7ba149348fd24a2761bab3d101f552ddb03b6874b6" name="avahi-compat-howl-devel" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="449a2577c80019f5dc60afb76077d098773b40913e939acab36c3ea530beda2d" name="avahi-compat-howl-devel" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="b3ceded30cb11d6d755a0a1078414e1713dc2ef976b685fecd268ee6d0b25c20" name="avahi-compat-howl-devel" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="efb50eb5137018f5c1be72147cedcee9881a319e5c18e9df3c98f080823725a7" name="avahi-compat-mDNSResponder-devel" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="627ca61977281fb2c86d3846d26973833e9d41cd3da239e18cd122a63e197208" name="avahi-compat-mDNSResponder-devel" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="4a1ff6b564bb48be5675d3e4bf7e88a22fbd2925ed03d7c6383cba223487a165" name="avahi-compat-mDNSResponder-devel" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="15a848753b10af6cbac6e8aee6da4ae8b2011e0601501d354cd565f0dbbc93e2" name="avahi-compat-mDNSResponder-devel" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="0aa6454f046b1f359307c7a2c13ed0af821c211a87c3d726e5871d5d0e622666" name="avahi-compat-mDNSResponder-devel" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="9027b7f0eb50d3ede5062925cecbba1196a8432acd049662c2d39c482f3e4f5f" name="avahi-compat-mDNSResponder-devel" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="14586d827fe13fd1d6ec1de17a3d3309e06572441864fce5c2a2b3ced9048cf8" name="avahi-compat-mDNSResponder-devel" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="ad7673121b866622cafb1bc49c1df1ff6df280cbafee6520bb307fb95032031c" name="avahi-compat-mDNSResponder-devel" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="067cf9d76cc9b129bb56cceb183e74816517c9ff97386c1a0589ac5cc9a6d465" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.6.32" rel="5.13.1"/>
  <changelog author="sbrabec@suse.cz" date="1216382400">- Build glib2, gobject and python stuff separately to break build
  loop cups -&gt; gtk2 -&gt; avahi -&gt; cups.
- Split avahi-python-gtk from avahi-python.
- Updated to version 0.6.23:
  * A lot of translation updates
  * Beef up bnvc quite a bit, including passing a domain to browse
    in
  * Increase numer of open files resource limit to 300 so that we
    can deal with more clients simultaneously.
  * Rework 'poof' algorithm a bit to reduce traffic load on noisy
    links.
  * Build fixes
  * Minor other updates
  * Backwards compatible with Avahi 0.6.x with x &lt; 23.</changelog>
  <changelog author="aj@suse.de" date="1217073600">- Fix requires to require avahi base package.</changelog>
  <changelog author="ro@suse.de" date="1217592000">- fix requires for debuginfo package</changelog>
  <changelog author="ro@suse.de" date="1217764800">- move fix further up in specfile</changelog>
  <changelog author="meissner@suse.de" date="1220270400">- Added GCC attribute alloc_size markup for allocator functions</changelog>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="a33845f161856c810e77b7e257bdfde3017373de3e0991d188f8e8a44315bf15" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="sbrabec@suse.cz" date="1216382400">- Build glib2, gobject and python stuff separately to break build
  loop cups -&gt; gtk2 -&gt; avahi -&gt; cups.
- Split avahi-python-gtk from avahi-python.
- Updated to version 0.6.23:
  * A lot of translation updates
  * Beef up bnvc quite a bit, including passing a domain to browse
    in
  * Increase numer of open files resource limit to 300 so that we
    can deal with more clients simultaneously.
  * Rework 'poof' algorithm a bit to reduce traffic load on noisy
    links.
  * Build fixes
  * Minor other updates
  * Backwards compatible with Avahi 0.6.x with x &lt; 23.</changelog>
  <changelog author="aj@suse.de" date="1217073600">- Fix requires to require avahi base package.</changelog>
  <changelog author="ro@suse.de" date="1217592000">- fix requires for debuginfo package</changelog>
  <changelog author="ro@suse.de" date="1217764800">- move fix further up in specfile</changelog>
  <changelog author="meissner@suse.de" date="1220270400">- Added GCC attribute alloc_size markup for allocator functions</changelog>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="8ed440d85fc6d4f1e09a10f1960df968c685d2d59c8cf560c754fcff0c201674" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="sbrabec@suse.cz" date="1216382400">- Build glib2, gobject and python stuff separately to break build
  loop cups -&gt; gtk2 -&gt; avahi -&gt; cups.
- Split avahi-python-gtk from avahi-python.
- Updated to version 0.6.23:
  * A lot of translation updates
  * Beef up bnvc quite a bit, including passing a domain to browse
    in
  * Increase numer of open files resource limit to 300 so that we
    can deal with more clients simultaneously.
  * Rework 'poof' algorithm a bit to reduce traffic load on noisy
    links.
  * Build fixes
  * Minor other updates
  * Backwards compatible with Avahi 0.6.x with x &lt; 23.</changelog>
  <changelog author="aj@suse.de" date="1217073600">- Fix requires to require avahi base package.</changelog>
  <changelog author="ro@suse.de" date="1217592000">- fix requires for debuginfo package</changelog>
  <changelog author="ro@suse.de" date="1217764800">- move fix further up in specfile</changelog>
  <changelog author="meissner@suse.de" date="1220270400">- Added GCC attribute alloc_size markup for allocator functions</changelog>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="8d96e73ab889a81257b8183f07795a2ee3d1bdbf57b96fc5a17d5acf47e636d1" name="avahi-lang" arch="noarch">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="479004b57717fb63b4194fe3d714c3818c7046239fe85d513cdfa8f8944388b5" name="avahi-lang" arch="noarch">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="de13092a5b761846ead26b9a7c2469036ef7a1ce97400228d20825a773685930" name="avahi-utils" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="903a51034a4bf9bd6cd2dfd81aab82dc29e60a0f9df458eb5b76c766da6fb692" name="avahi-utils" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="6e0a72cbc15e718177ff04a165060128277b0a56442e687e0e7453962a069fc3" name="avahi-utils" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="a1c4e6db15168e87a03cf095e342f40add556fc5bb84e5157629054e56f91cfa" name="avahi-utils" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="a879922fb47990f976de5b5ff57120fb9edb35e48ad14d9acae9440344e7e2e0" name="avahi-utils" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="3742eb28900e3db808435f46ed86298c87f81c2e1cd27a6ae721addfb7fad84e" name="avahi-utils" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="01debf8ff76f31965d676fce12e08f97e2196548cf1a7c30d3cf31f812bcd260" name="avahi-utils" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="b62461eff98a976105d10572908823c176fe30f6091e2a748069e5b460efa31c" name="avahi-utils" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
</package>
<package pkgid="a3a47315097fe191527211633173eda72d3b7dfc706122267d690613d22a51ca" name="avahi-utils-gtk" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="e78c769a150ca89c6fd9e5251030657acc81577d35cc333001855db82dc2bb74" name="avahi-utils-gtk" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="cf1923cf7fd7a5d9b5bb1ae87b6198001ffefcd791b2b95c6996ba570bbfe361" name="avahi-utils-gtk" arch="s390x">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="79ad600ff3b233c784ab402f55a51557804f3fd7a9a5e9af316a53ad7f8b568c" name="avahi-utils-gtk" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="b476c4d919d523eba47bdb0c90c8b4f6dd20d17ec00b49c583c0ec26f17fddbb" name="avahi-utils-gtk" arch="aarch64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="faca3483948252e9af2382c49ba75a67f217873cf02eae81103748af233ad570" name="avahi-utils-gtk" arch="ppc64le">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="b3a8a23e710405dc685667a4177d37c6b2ddc22d6d56ee757faf66d4ed279dd9" name="avahi-utils-gtk" arch="s390x">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="14007dec9510ec6f60647ef377216bd1891ed73ad1e03e60da32b7f8e280bf89" name="avahi-utils-gtk" arch="x86_64">
  <version epoch="0" ver="0.7" rel="3.18.1"/>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="baf692b9729f1bac6a24b688e8e3e6f7980ba862ef3a09b8efcb5597cbd9a2f9" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.19.9" rel="26.1"/>
  <changelog author="rjschwei@suse.com" date="1569585600">- Add groff as a dependency (boo# 1152258)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571054400">- Update to version 1.16.258
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.258/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1573732800">- Update to version 1.16.281
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.281/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16.297
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.297/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1580385600">- Update to version 1.17.9
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.17.9/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="3364a4d4e9bd89cb763819eaef74db3943cec6b8f8c7204dc6c88becb370d1bb" name="aws-cli" arch="src">
  <version epoch="0" ver="1.19.9" rel="26.1"/>
  <changelog author="rjschwei@suse.com" date="1569585600">- Add groff as a dependency (boo# 1152258)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571054400">- Update to version 1.16.258
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.258/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1573732800">- Update to version 1.16.281
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.281/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16.297
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.297/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1580385600">- Update to version 1.17.9
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.17.9/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="c8107b48b43ebe2115e2278a6d6fcecf6125f791bc17153cb8d62d7d3eb3df96" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.20.7" rel="30.3.1"/>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="48f07930b2efc7e061b897786094237a3801a5d70a4d779c9f3e1f0f6f5b0c9f" name="aws-cli" arch="src">
  <version epoch="0" ver="1.20.7" rel="30.3.1"/>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="eaac712c518a57a4b5327b5c9a69aed036d9a2ff97eb6597d3c46c4c6943a7d1" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.24.4" rel="150200.30.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473601">- Update to version 1.20.7
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1631275200">- Update to version 1.20.32
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.32/CHANGELOG.rst
- Fix rpmlint warnings
  + use defattr for default permissions
  + mark zsh completion file as a config file
- Use github download url as a Source0
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Update to version 1.21.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.21.6/CHANGELOG.rst
- Relax upper version dependency for python-docutils in Requires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Update to version 1.22.24
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.24/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641470400">- Update to version 1.22.28
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.28/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Update to version 1.22.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.35/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Update to version 1.22.46
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.46/CHANGELOG.rst
- Add missing python-rpm-macros to BuildRequires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Update to version 1.22.65
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.65/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to version 1.22.87
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.87/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to version 1.23.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652356800">- Update to version 1.23.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.11/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to version 1.24.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to version 1.24.4 (bsc#1199716)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.4/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="93cede7a5faa828620f6f96ad50684bd53dc96d48d577d2cebcf6bc1f4512e9c" name="aws-cli" arch="src">
  <version epoch="0" ver="1.24.4" rel="150200.30.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473601">- Update to version 1.20.7
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1631275200">- Update to version 1.20.32
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.32/CHANGELOG.rst
- Fix rpmlint warnings
  + use defattr for default permissions
  + mark zsh completion file as a config file
- Use github download url as a Source0
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Update to version 1.21.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.21.6/CHANGELOG.rst
- Relax upper version dependency for python-docutils in Requires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Update to version 1.22.24
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.24/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641470400">- Update to version 1.22.28
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.28/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Update to version 1.22.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.35/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Update to version 1.22.46
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.46/CHANGELOG.rst
- Add missing python-rpm-macros to BuildRequires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Update to version 1.22.65
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.65/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to version 1.22.87
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.87/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to version 1.23.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652356800">- Update to version 1.23.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.11/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to version 1.24.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to version 1.24.4 (bsc#1199716)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.4/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="5243cad462949db9a591a77028d9459ebf34320128b7b1b8737bc788091c25cf" name="aws-efs-utils" arch="noarch">
  <version epoch="0" ver="1.31.3" rel="150100.4.5.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1549713600">- Initial build (bsc#1101451, fate#327220, bsc#1124652, fate#327221)
  + Version 1.5</changelog>
  <changelog author="jengelh@inai.de" date="1549886400">- Ensure neutrality of descriptions.</changelog>
  <changelog author="rjschwei@suse.com" date="1550145600">- Support Python 3.2 and later
  + Add efs-switchparser.patch
  + SafeConfigParser is no longer available, use ConfigParser</changelog>
  <changelog author="rjschwei@suse.com" date="1550145601">- Rename from amazon-efs-utils to aws-efs-utils</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554292800">- Include hardening and robustness fixes from security audit (bsc#1125133)
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554811200">- Update to version 1.7
  + subprocess usage: explicitly pass `close_fds = True`
  + state_file_dir: choose safe default mode, make mode configurable
  + choose_tls_port(): reuse socket and explicitly close it in all cases
  + watchdog: be robust against unrelated localhost based nfs mounts
- Drop hardening patches merged upstream
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch
- from version 1.6
  + fix for additional unexpected arguments
  + add test for additional unexpected arguments</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1556020800">- Include in SLE-15 (FATE#327220, bsc#1101451)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16
  + Support Python 3 for tests
- from version 1.15
  + Properly support Python3
- from version 1.14
  + Tolerate EFS state directory existing during mount
- from version 1.13
  + Change watchdog configuration so it stops after all file systems are unmounted
- from version 1.12
  + Update stunnel idle timeout
  * The default stunnel idle timeout is many hours. By setting it to a value based
    on the NFS lease length we can recover from network partitions sooner.
- from version 1.11
  + Add support for RHEL8
  * Fixes Python shebangs to work on systems without a default "python" version.
  * Fixes watchdog process not being properly started on systemd systems.
- from version 1.10
  + Update to default configuration that disables OCSP
  * To use OCSP, the client accessing EFS must be able to reach the Amazon Certificate
    Authority (CA). To maximize file system availability in the event that the CA is
    not reachable from your VPC, the EFS mount helper no longer enables OCSP by default.
- Don't enable testsuite as it is currently failing
  + https://github.com/aws/efs-utils/issues/24
- Drop patches merged upstream
  + efs-switchparser.patch
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1576584000">- Update to version 1.17
  + Added support for Python 3
- Enable testsuite which now passes on Python 3
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Drop '-f' option with %service_del_preun/%service_del_postun
  With %service_del_preun, the option is already ignored with as
  support for DISABLE_STOP_ON_REMOVAL has been dropped.
  With %service_del_postun, this option shouldn't be needed besides
  very few special cases. But this package doesn't seem to belong to
  this category.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624536000">- Update to version 1.31.2
  + Handle HTTPError and other unknown exception when fetching IMDS token
  + Support Oracle Enterprise Linux 8
- from version 1.31.1
  + Support fallback to mount with mount target ip address when DNS resolution fails
  + Bump py from 1.8.0 to 1.10.0
- from version 1.30.2
  + Add helper message when config file on instance is not latest
  + Fix the throughput regression due to read_ahead configuration change
    on Linux distribution with kernel version 5.4.x and above
- from version 1.30.1
  + Support mounting to specific AZ mount target
  + Revert "Support mounting to specific AZ mount target"
  + Support mounting to specific AZ mount target
  + Use regional AWS STS endpoints instead of the global endpoint to reduce latency
- from version 1.29.1-mac
  + Fix issue where state files are removed after mount on EC2
    instances running on MacOS Big Sur
  + Add support for EC2 Mac instances running macOS Big Sur
- from version 1.29.1
  + Update the python dependency to python3
  + Fix typo
- from version 1.28.2
  + Fix the issue that mounting with IAM authorization with
    iam role does not work with IMDSv2
- from version 1.28.1
  + Support publishing mount success/failure notification via CloudWatch log
  + filename of .deb-package now includes architecture
- from version 1.27.1
  + Merge PR #60 on GitHub. Adds support for AssumeRoleWithWebIdentity.
  + Add support for AssumeRoleWithWebIdentity
- from version 1.26.3
  + Fix an issue where watchdog crashed during restart because stunnel
    was killed and pid key was removed from state file
- from version 1.26.2
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container * Fixes an issue where fs cannot be mounted with tls
    using systemd.automount-units due to mountpoint check
  + Revert "Fixes an issue with watchdog where it sometimes fails to restart stunnels
    in efs-csi-driver container"
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container
  + Remove non-ascii character in dist/efs-utils.conf
- from version 1.25-3
  + Check if mountpoint is already mounted beforehand for tls mount
  + Bug fix and enhancement, support fedora
- from version 1.25-2
  + Fix python3 IAM role name encoded format, add optional
    override for stunnel log
  + Encode IAM role name to UTF-8
- from version 1.25-1
  + Create self-signed certificate for tls-only mount
  + add CentOS 8 support
- from version 1.24
  + Fix the malformed certificate info
  + bump the release id to 3
  + Use IMDSv1 by default, and use IMDSv2 where required
  + Revert "Use IMDSv1 by default, and fall back to IMDSv2 if necessary"
  + Use IMDSv1 by default, and fall back to IMDSv2 if necessary
  + Modify rhel8-support.sh to handle Fedora as well, and rename it
  + Remove which from DEB package dependency
  + List which as dependency to search command exec path
  + Enable region sourcing from efs-utils configuration file and fix
    stunnel exec path issue in openSUSE
  + Update rpm changelog for v1.23-2, fix circleCI build issue
- from version 1.23
  + Add support for Amazon Elastic Container Service
- from version 1.22
  + Improvements to metadata retrieval and IAM authentication
- from version 1.21
  + Improvements to auth and access point support
- from version 1.20
  + Fixes the mount issue with full DNS name in the AWS China Regions;
    Upgrades unit test coverage version dependency to enable accurate
    python3.8 coverage test
- from version 1.19
  + Added region localization, Integrate repository with CircleCI to enable
    package build visualization, Unit tests bug fixes for python3.5
- from version 1.18
  + Support IAM authentication and access points.
- Add patch to disable mount_efs_test which requires networking
  + disable_mount_efs_test.patch
- Add openssl to BuildRequires, required for testsuite
- Update Requires from requirements.txt</changelog>
  <changelog author="jsegitz@suse.com" date="1628683200">- Added hardening to systemd service(s). Added patch(es):
  * harden_amazon-efs-mount-watchdog.service.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1645185600">- Update to version 1.31.3 (bsc#1195916)
  + Add skip-styletest.patch
  - Style is enforced upstream and triggers unnecessary build version
    requirements
  + Allow specifying fs_id in cloudwatch log group name
  + Includes fix for stunnel path</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646827200">- Remove redundant python3 dependency from Requires
- Update regular expression to fix python shebang</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)</changelog>
</package>
<package pkgid="93f9507f41f0aa2edb6ec623821ebaa6b00b2e3ecc3a6668a08d725b5162a67e" name="aws-efs-utils" arch="src">
  <version epoch="0" ver="1.31.3" rel="150100.4.5.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1549713600">- Initial build (bsc#1101451, fate#327220, bsc#1124652, fate#327221)
  + Version 1.5</changelog>
  <changelog author="jengelh@inai.de" date="1549886400">- Ensure neutrality of descriptions.</changelog>
  <changelog author="rjschwei@suse.com" date="1550145600">- Support Python 3.2 and later
  + Add efs-switchparser.patch
  + SafeConfigParser is no longer available, use ConfigParser</changelog>
  <changelog author="rjschwei@suse.com" date="1550145601">- Rename from amazon-efs-utils to aws-efs-utils</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554292800">- Include hardening and robustness fixes from security audit (bsc#1125133)
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554811200">- Update to version 1.7
  + subprocess usage: explicitly pass `close_fds = True`
  + state_file_dir: choose safe default mode, make mode configurable
  + choose_tls_port(): reuse socket and explicitly close it in all cases
  + watchdog: be robust against unrelated localhost based nfs mounts
- Drop hardening patches merged upstream
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch
- from version 1.6
  + fix for additional unexpected arguments
  + add test for additional unexpected arguments</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1556020800">- Include in SLE-15 (FATE#327220, bsc#1101451)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16
  + Support Python 3 for tests
- from version 1.15
  + Properly support Python3
- from version 1.14
  + Tolerate EFS state directory existing during mount
- from version 1.13
  + Change watchdog configuration so it stops after all file systems are unmounted
- from version 1.12
  + Update stunnel idle timeout
  * The default stunnel idle timeout is many hours. By setting it to a value based
    on the NFS lease length we can recover from network partitions sooner.
- from version 1.11
  + Add support for RHEL8
  * Fixes Python shebangs to work on systems without a default "python" version.
  * Fixes watchdog process not being properly started on systemd systems.
- from version 1.10
  + Update to default configuration that disables OCSP
  * To use OCSP, the client accessing EFS must be able to reach the Amazon Certificate
    Authority (CA). To maximize file system availability in the event that the CA is
    not reachable from your VPC, the EFS mount helper no longer enables OCSP by default.
- Don't enable testsuite as it is currently failing
  + https://github.com/aws/efs-utils/issues/24
- Drop patches merged upstream
  + efs-switchparser.patch
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1576584000">- Update to version 1.17
  + Added support for Python 3
- Enable testsuite which now passes on Python 3
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Drop '-f' option with %service_del_preun/%service_del_postun
  With %service_del_preun, the option is already ignored with as
  support for DISABLE_STOP_ON_REMOVAL has been dropped.
  With %service_del_postun, this option shouldn't be needed besides
  very few special cases. But this package doesn't seem to belong to
  this category.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624536000">- Update to version 1.31.2
  + Handle HTTPError and other unknown exception when fetching IMDS token
  + Support Oracle Enterprise Linux 8
- from version 1.31.1
  + Support fallback to mount with mount target ip address when DNS resolution fails
  + Bump py from 1.8.0 to 1.10.0
- from version 1.30.2
  + Add helper message when config file on instance is not latest
  + Fix the throughput regression due to read_ahead configuration change
    on Linux distribution with kernel version 5.4.x and above
- from version 1.30.1
  + Support mounting to specific AZ mount target
  + Revert "Support mounting to specific AZ mount target"
  + Support mounting to specific AZ mount target
  + Use regional AWS STS endpoints instead of the global endpoint to reduce latency
- from version 1.29.1-mac
  + Fix issue where state files are removed after mount on EC2
    instances running on MacOS Big Sur
  + Add support for EC2 Mac instances running macOS Big Sur
- from version 1.29.1
  + Update the python dependency to python3
  + Fix typo
- from version 1.28.2
  + Fix the issue that mounting with IAM authorization with
    iam role does not work with IMDSv2
- from version 1.28.1
  + Support publishing mount success/failure notification via CloudWatch log
  + filename of .deb-package now includes architecture
- from version 1.27.1
  + Merge PR #60 on GitHub. Adds support for AssumeRoleWithWebIdentity.
  + Add support for AssumeRoleWithWebIdentity
- from version 1.26.3
  + Fix an issue where watchdog crashed during restart because stunnel
    was killed and pid key was removed from state file
- from version 1.26.2
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container * Fixes an issue where fs cannot be mounted with tls
    using systemd.automount-units due to mountpoint check
  + Revert "Fixes an issue with watchdog where it sometimes fails to restart stunnels
    in efs-csi-driver container"
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container
  + Remove non-ascii character in dist/efs-utils.conf
- from version 1.25-3
  + Check if mountpoint is already mounted beforehand for tls mount
  + Bug fix and enhancement, support fedora
- from version 1.25-2
  + Fix python3 IAM role name encoded format, add optional
    override for stunnel log
  + Encode IAM role name to UTF-8
- from version 1.25-1
  + Create self-signed certificate for tls-only mount
  + add CentOS 8 support
- from version 1.24
  + Fix the malformed certificate info
  + bump the release id to 3
  + Use IMDSv1 by default, and use IMDSv2 where required
  + Revert "Use IMDSv1 by default, and fall back to IMDSv2 if necessary"
  + Use IMDSv1 by default, and fall back to IMDSv2 if necessary
  + Modify rhel8-support.sh to handle Fedora as well, and rename it
  + Remove which from DEB package dependency
  + List which as dependency to search command exec path
  + Enable region sourcing from efs-utils configuration file and fix
    stunnel exec path issue in openSUSE
  + Update rpm changelog for v1.23-2, fix circleCI build issue
- from version 1.23
  + Add support for Amazon Elastic Container Service
- from version 1.22
  + Improvements to metadata retrieval and IAM authentication
- from version 1.21
  + Improvements to auth and access point support
- from version 1.20
  + Fixes the mount issue with full DNS name in the AWS China Regions;
    Upgrades unit test coverage version dependency to enable accurate
    python3.8 coverage test
- from version 1.19
  + Added region localization, Integrate repository with CircleCI to enable
    package build visualization, Unit tests bug fixes for python3.5
- from version 1.18
  + Support IAM authentication and access points.
- Add patch to disable mount_efs_test which requires networking
  + disable_mount_efs_test.patch
- Add openssl to BuildRequires, required for testsuite
- Update Requires from requirements.txt</changelog>
  <changelog author="jsegitz@suse.com" date="1628683200">- Added hardening to systemd service(s). Added patch(es):
  * harden_amazon-efs-mount-watchdog.service.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1645185600">- Update to version 1.31.3 (bsc#1195916)
  + Add skip-styletest.patch
  - Style is enforced upstream and triggers unnecessary build version
    requirements
  + Allow specifying fs_id in cloudwatch log group name
  + Includes fix for stunnel path</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646827200">- Remove redundant python3 dependency from Requires
- Update regular expression to fix python shebang</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)</changelog>
</package>
<package pkgid="d7a6a1070e46060875bc0c7a8c970cca676410e0a47e5cea700b8c29e2639dc6" name="aws-efs-utils" arch="noarch">
  <version epoch="0" ver="1.33.4" rel="150100.4.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1549713600">- Initial build (bsc#1101451, fate#327220, bsc#1124652, fate#327221)
  + Version 1.5</changelog>
  <changelog author="jengelh@inai.de" date="1549886400">- Ensure neutrality of descriptions.</changelog>
  <changelog author="rjschwei@suse.com" date="1550145600">- Support Python 3.2 and later
  + Add efs-switchparser.patch
  + SafeConfigParser is no longer available, use ConfigParser</changelog>
  <changelog author="rjschwei@suse.com" date="1550145601">- Rename from amazon-efs-utils to aws-efs-utils</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554292800">- Include hardening and robustness fixes from security audit (bsc#1125133)
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554811200">- Update to version 1.7
  + subprocess usage: explicitly pass `close_fds = True`
  + state_file_dir: choose safe default mode, make mode configurable
  + choose_tls_port(): reuse socket and explicitly close it in all cases
  + watchdog: be robust against unrelated localhost based nfs mounts
- Drop hardening patches merged upstream
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch
- from version 1.6
  + fix for additional unexpected arguments
  + add test for additional unexpected arguments</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1556020800">- Include in SLE-15 (FATE#327220, bsc#1101451)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16
  + Support Python 3 for tests
- from version 1.15
  + Properly support Python3
- from version 1.14
  + Tolerate EFS state directory existing during mount
- from version 1.13
  + Change watchdog configuration so it stops after all file systems are unmounted
- from version 1.12
  + Update stunnel idle timeout
  * The default stunnel idle timeout is many hours. By setting it to a value based
    on the NFS lease length we can recover from network partitions sooner.
- from version 1.11
  + Add support for RHEL8
  * Fixes Python shebangs to work on systems without a default "python" version.
  * Fixes watchdog process not being properly started on systemd systems.
- from version 1.10
  + Update to default configuration that disables OCSP
  * To use OCSP, the client accessing EFS must be able to reach the Amazon Certificate
    Authority (CA). To maximize file system availability in the event that the CA is
    not reachable from your VPC, the EFS mount helper no longer enables OCSP by default.
- Don't enable testsuite as it is currently failing
  + https://github.com/aws/efs-utils/issues/24
- Drop patches merged upstream
  + efs-switchparser.patch
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1576584000">- Update to version 1.17
  + Added support for Python 3
- Enable testsuite which now passes on Python 3
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Drop '-f' option with %service_del_preun/%service_del_postun
  With %service_del_preun, the option is already ignored with as
  support for DISABLE_STOP_ON_REMOVAL has been dropped.
  With %service_del_postun, this option shouldn't be needed besides
  very few special cases. But this package doesn't seem to belong to
  this category.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624536000">- Update to version 1.31.2
  + Handle HTTPError and other unknown exception when fetching IMDS token
  + Support Oracle Enterprise Linux 8
- from version 1.31.1
  + Support fallback to mount with mount target ip address when DNS resolution fails
  + Bump py from 1.8.0 to 1.10.0
- from version 1.30.2
  + Add helper message when config file on instance is not latest
  + Fix the throughput regression due to read_ahead configuration change
    on Linux distribution with kernel version 5.4.x and above
- from version 1.30.1
  + Support mounting to specific AZ mount target
  + Revert "Support mounting to specific AZ mount target"
  + Support mounting to specific AZ mount target
  + Use regional AWS STS endpoints instead of the global endpoint to reduce latency
- from version 1.29.1-mac
  + Fix issue where state files are removed after mount on EC2
    instances running on MacOS Big Sur
  + Add support for EC2 Mac instances running macOS Big Sur
- from version 1.29.1
  + Update the python dependency to python3
  + Fix typo
- from version 1.28.2
  + Fix the issue that mounting with IAM authorization with
    iam role does not work with IMDSv2
- from version 1.28.1
  + Support publishing mount success/failure notification via CloudWatch log
  + filename of .deb-package now includes architecture
- from version 1.27.1
  + Merge PR #60 on GitHub. Adds support for AssumeRoleWithWebIdentity.
  + Add support for AssumeRoleWithWebIdentity
- from version 1.26.3
  + Fix an issue where watchdog crashed during restart because stunnel
    was killed and pid key was removed from state file
- from version 1.26.2
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container * Fixes an issue where fs cannot be mounted with tls
    using systemd.automount-units due to mountpoint check
  + Revert "Fixes an issue with watchdog where it sometimes fails to restart stunnels
    in efs-csi-driver container"
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container
  + Remove non-ascii character in dist/efs-utils.conf
- from version 1.25-3
  + Check if mountpoint is already mounted beforehand for tls mount
  + Bug fix and enhancement, support fedora
- from version 1.25-2
  + Fix python3 IAM role name encoded format, add optional
    override for stunnel log
  + Encode IAM role name to UTF-8
- from version 1.25-1
  + Create self-signed certificate for tls-only mount
  + add CentOS 8 support
- from version 1.24
  + Fix the malformed certificate info
  + bump the release id to 3
  + Use IMDSv1 by default, and use IMDSv2 where required
  + Revert "Use IMDSv1 by default, and fall back to IMDSv2 if necessary"
  + Use IMDSv1 by default, and fall back to IMDSv2 if necessary
  + Modify rhel8-support.sh to handle Fedora as well, and rename it
  + Remove which from DEB package dependency
  + List which as dependency to search command exec path
  + Enable region sourcing from efs-utils configuration file and fix
    stunnel exec path issue in openSUSE
  + Update rpm changelog for v1.23-2, fix circleCI build issue
- from version 1.23
  + Add support for Amazon Elastic Container Service
- from version 1.22
  + Improvements to metadata retrieval and IAM authentication
- from version 1.21
  + Improvements to auth and access point support
- from version 1.20
  + Fixes the mount issue with full DNS name in the AWS China Regions;
    Upgrades unit test coverage version dependency to enable accurate
    python3.8 coverage test
- from version 1.19
  + Added region localization, Integrate repository with CircleCI to enable
    package build visualization, Unit tests bug fixes for python3.5
- from version 1.18
  + Support IAM authentication and access points.
- Add patch to disable mount_efs_test which requires networking
  + disable_mount_efs_test.patch
- Add openssl to BuildRequires, required for testsuite
- Update Requires from requirements.txt</changelog>
  <changelog author="jsegitz@suse.com" date="1628683200">- Added hardening to systemd service(s). Added patch(es):
  * harden_amazon-efs-mount-watchdog.service.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1645185600">- Update to version 1.31.3 (bsc#1195916)
  + Add skip-styletest.patch
  - Style is enforced upstream and triggers unnecessary build version
    requirements
  + Allow specifying fs_id in cloudwatch log group name
  + Includes fix for stunnel path</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646827200">- Remove redundant python3 dependency from Requires
- Update regular expression to fix python shebang</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)</changelog>
  <changelog author="pgajdos@suse.com" date="1651060800">- version update to 1.32.1
  * Enable watchdog to check stunnel health periodically and restart
    hanging stunnel process when necessary.
- do not require python-mock for build
  https://trello.com/c/S6eADbii/64-remove-python-mock</changelog>
  <changelog author="pgajdos@suse.com" date="1652875200">- version update to 1.33.1
  * Enable mount process to retry on failed or timed out mount.nfs command
  * use unittest.mock instead of mock</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663934400">- Update to version 1.33.4 (bsc#1203170)
  * Fix the issue where watchdog sending signal to incorrect
    processes and add FIPS mode support
  * Apply additional check on awscredsuri option
- from version 1.33.3
  * Fix the potential stunnel hanging issue caused by full
    subprocess PIPE filled by stunnel log
  * Specify FIPS mode in configuration
  * Add separate env_path for macOS; Add comments
  * Update get-pip.py download url in README
- from version 1.33.2
  * Fix the incorrect path to generate read_ahead_kb config file
    and Bump the default tls port range from 400 to 1000
- Add patch to use unittest.mock instead of mock in testsuite
  * use_mock_from_unittest.patch
- Use relative URL in Source field</changelog>
</package>
<package pkgid="bf43815920882f74eae69b29fafe278dd15ddc7c72e999df078ca52b65d295ce" name="aws-efs-utils" arch="src">
  <version epoch="0" ver="1.33.4" rel="150100.4.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1549713600">- Initial build (bsc#1101451, fate#327220, bsc#1124652, fate#327221)
  + Version 1.5</changelog>
  <changelog author="jengelh@inai.de" date="1549886400">- Ensure neutrality of descriptions.</changelog>
  <changelog author="rjschwei@suse.com" date="1550145600">- Support Python 3.2 and later
  + Add efs-switchparser.patch
  + SafeConfigParser is no longer available, use ConfigParser</changelog>
  <changelog author="rjschwei@suse.com" date="1550145601">- Rename from amazon-efs-utils to aws-efs-utils</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554292800">- Include hardening and robustness fixes from security audit (bsc#1125133)
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1554811200">- Update to version 1.7
  + subprocess usage: explicitly pass `close_fds = True`
  + state_file_dir: choose safe default mode, make mode configurable
  + choose_tls_port(): reuse socket and explicitly close it in all cases
  + watchdog: be robust against unrelated localhost based nfs mounts
- Drop hardening patches merged upstream
  + 0001-subprocess-usage-explicitly-pass-close_fds-True.patch
  + 0002-state_file_dir-choose-safe-default-mode-make-mode-co.patch
  + 0003-pytest-adjust-tests-to-new-state_file_dir_mode-confi.patch
  + 0004-choose_tls_port-reuse-socket-and-explicitly-close-it.patch
  + 0005-watchdog-be-robust-against-unrelated-localhost-based.patch
- from version 1.6
  + fix for additional unexpected arguments
  + add test for additional unexpected arguments</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1556020800">- Include in SLE-15 (FATE#327220, bsc#1101451)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16
  + Support Python 3 for tests
- from version 1.15
  + Properly support Python3
- from version 1.14
  + Tolerate EFS state directory existing during mount
- from version 1.13
  + Change watchdog configuration so it stops after all file systems are unmounted
- from version 1.12
  + Update stunnel idle timeout
  * The default stunnel idle timeout is many hours. By setting it to a value based
    on the NFS lease length we can recover from network partitions sooner.
- from version 1.11
  + Add support for RHEL8
  * Fixes Python shebangs to work on systems without a default "python" version.
  * Fixes watchdog process not being properly started on systemd systems.
- from version 1.10
  + Update to default configuration that disables OCSP
  * To use OCSP, the client accessing EFS must be able to reach the Amazon Certificate
    Authority (CA). To maximize file system availability in the event that the CA is
    not reachable from your VPC, the EFS mount helper no longer enables OCSP by default.
- Don't enable testsuite as it is currently failing
  + https://github.com/aws/efs-utils/issues/24
- Drop patches merged upstream
  + efs-switchparser.patch
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1576584000">- Update to version 1.17
  + Added support for Python 3
- Enable testsuite which now passes on Python 3
- Update BuildRequires from requirements.txt</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Drop '-f' option with %service_del_preun/%service_del_postun
  With %service_del_preun, the option is already ignored with as
  support for DISABLE_STOP_ON_REMOVAL has been dropped.
  With %service_del_postun, this option shouldn't be needed besides
  very few special cases. But this package doesn't seem to belong to
  this category.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624536000">- Update to version 1.31.2
  + Handle HTTPError and other unknown exception when fetching IMDS token
  + Support Oracle Enterprise Linux 8
- from version 1.31.1
  + Support fallback to mount with mount target ip address when DNS resolution fails
  + Bump py from 1.8.0 to 1.10.0
- from version 1.30.2
  + Add helper message when config file on instance is not latest
  + Fix the throughput regression due to read_ahead configuration change
    on Linux distribution with kernel version 5.4.x and above
- from version 1.30.1
  + Support mounting to specific AZ mount target
  + Revert "Support mounting to specific AZ mount target"
  + Support mounting to specific AZ mount target
  + Use regional AWS STS endpoints instead of the global endpoint to reduce latency
- from version 1.29.1-mac
  + Fix issue where state files are removed after mount on EC2
    instances running on MacOS Big Sur
  + Add support for EC2 Mac instances running macOS Big Sur
- from version 1.29.1
  + Update the python dependency to python3
  + Fix typo
- from version 1.28.2
  + Fix the issue that mounting with IAM authorization with
    iam role does not work with IMDSv2
- from version 1.28.1
  + Support publishing mount success/failure notification via CloudWatch log
  + filename of .deb-package now includes architecture
- from version 1.27.1
  + Merge PR #60 on GitHub. Adds support for AssumeRoleWithWebIdentity.
  + Add support for AssumeRoleWithWebIdentity
- from version 1.26.3
  + Fix an issue where watchdog crashed during restart because stunnel
    was killed and pid key was removed from state file
- from version 1.26.2
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container * Fixes an issue where fs cannot be mounted with tls
    using systemd.automount-units due to mountpoint check
  + Revert "Fixes an issue with watchdog where it sometimes fails to restart stunnels
    in efs-csi-driver container"
  + Fixes an issue with watchdog where it sometimes fails to restart stunnels in
    efs-csi-driver container
  + Remove non-ascii character in dist/efs-utils.conf
- from version 1.25-3
  + Check if mountpoint is already mounted beforehand for tls mount
  + Bug fix and enhancement, support fedora
- from version 1.25-2
  + Fix python3 IAM role name encoded format, add optional
    override for stunnel log
  + Encode IAM role name to UTF-8
- from version 1.25-1
  + Create self-signed certificate for tls-only mount
  + add CentOS 8 support
- from version 1.24
  + Fix the malformed certificate info
  + bump the release id to 3
  + Use IMDSv1 by default, and use IMDSv2 where required
  + Revert "Use IMDSv1 by default, and fall back to IMDSv2 if necessary"
  + Use IMDSv1 by default, and fall back to IMDSv2 if necessary
  + Modify rhel8-support.sh to handle Fedora as well, and rename it
  + Remove which from DEB package dependency
  + List which as dependency to search command exec path
  + Enable region sourcing from efs-utils configuration file and fix
    stunnel exec path issue in openSUSE
  + Update rpm changelog for v1.23-2, fix circleCI build issue
- from version 1.23
  + Add support for Amazon Elastic Container Service
- from version 1.22
  + Improvements to metadata retrieval and IAM authentication
- from version 1.21
  + Improvements to auth and access point support
- from version 1.20
  + Fixes the mount issue with full DNS name in the AWS China Regions;
    Upgrades unit test coverage version dependency to enable accurate
    python3.8 coverage test
- from version 1.19
  + Added region localization, Integrate repository with CircleCI to enable
    package build visualization, Unit tests bug fixes for python3.5
- from version 1.18
  + Support IAM authentication and access points.
- Add patch to disable mount_efs_test which requires networking
  + disable_mount_efs_test.patch
- Add openssl to BuildRequires, required for testsuite
- Update Requires from requirements.txt</changelog>
  <changelog author="jsegitz@suse.com" date="1628683200">- Added hardening to systemd service(s). Added patch(es):
  * harden_amazon-efs-mount-watchdog.service.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1645185600">- Update to version 1.31.3 (bsc#1195916)
  + Add skip-styletest.patch
  - Style is enforced upstream and triggers unnecessary build version
    requirements
  + Allow specifying fs_id in cloudwatch log group name
  + Includes fix for stunnel path</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646827200">- Remove redundant python3 dependency from Requires
- Update regular expression to fix python shebang</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)</changelog>
  <changelog author="pgajdos@suse.com" date="1651060800">- version update to 1.32.1
  * Enable watchdog to check stunnel health periodically and restart
    hanging stunnel process when necessary.
- do not require python-mock for build
  https://trello.com/c/S6eADbii/64-remove-python-mock</changelog>
  <changelog author="pgajdos@suse.com" date="1652875200">- version update to 1.33.1
  * Enable mount process to retry on failed or timed out mount.nfs command
  * use unittest.mock instead of mock</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663934400">- Update to version 1.33.4 (bsc#1203170)
  * Fix the issue where watchdog sending signal to incorrect
    processes and add FIPS mode support
  * Apply additional check on awscredsuri option
- from version 1.33.3
  * Fix the potential stunnel hanging issue caused by full
    subprocess PIPE filled by stunnel log
  * Specify FIPS mode in configuration
  * Add separate env_path for macOS; Add comments
  * Update get-pip.py download url in README
- from version 1.33.2
  * Fix the incorrect path to generate read_ahead_kb config file
    and Bump the default tls port range from 400 to 1000
- Add patch to use unittest.mock instead of mock in testsuite
  * use_mock_from_unittest.patch
- Use relative URL in Source field</changelog>
</package>
<package pkgid="3cb8fbdc66e931032f4f1e46a74fce2cada5d14b5b06546e6101fccfb8efa05d" name="aws-iam-authenticator" arch="aarch64">
  <version epoch="0" ver="0.5.3" rel="150000.1.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
</package>
<package pkgid="8fd3f04d3e5c030b3629e9b83614c1380b452bf1ed04296839a63c2ffd9f85a5" name="aws-iam-authenticator" arch="ppc64le">
  <version epoch="0" ver="0.5.3" rel="150000.1.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
</package>
<package pkgid="a9e9493d13d32ef5d1aebead3aaf016ce4f5753263697876c63f5425432f5921" name="aws-iam-authenticator" arch="s390x">
  <version epoch="0" ver="0.5.3" rel="150000.1.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
</package>
<package pkgid="fc4a02eea496a53058911e4d2457df51e5de5ea14fdc0a05621697efbf59d28e" name="aws-iam-authenticator" arch="src">
  <version epoch="0" ver="0.5.3" rel="150000.1.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
</package>
<package pkgid="858579a5d95215060a1daa4fd6a08a34c9c14816f0c944b32b6cc37a6d0b338e" name="aws-iam-authenticator" arch="x86_64">
  <version epoch="0" ver="0.5.3" rel="150000.1.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
</package>
<package pkgid="96b5d957e36fe17d4b2351d0edee84172244574b270000ffc6b4ab81d2e43095" name="aws-iam-authenticator" arch="aarch64">
  <version epoch="0" ver="0.5.3" rel="150000.1.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
</package>
<package pkgid="4678d34a8d31b9489a30a64eb5c93ddd3c26cb97863cf5fc57349739b27491e5" name="aws-iam-authenticator" arch="ppc64le">
  <version epoch="0" ver="0.5.3" rel="150000.1.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
</package>
<package pkgid="6a8518ccc0fd612292e2b1a1fbffd118e3a441b13c51d514de817fa0a4cf3094" name="aws-iam-authenticator" arch="s390x">
  <version epoch="0" ver="0.5.3" rel="150000.1.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
</package>
<package pkgid="f1ec37b23d3c1fda038e4bf39bff8696085832fe01b86b6d0338bcf707c1471b" name="aws-iam-authenticator" arch="src">
  <version epoch="0" ver="0.5.3" rel="150000.1.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
</package>
<package pkgid="2024b87af95c100fb41c66ed34f2651394ee43794d3aea9dfbe07f335b889d62" name="aws-iam-authenticator" arch="x86_64">
  <version epoch="0" ver="0.5.3" rel="150000.1.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
</package>
<package pkgid="1aaea925d4a65753d69c0edb75175926d6340a35bc73e2e988b4ad598d9cc002" name="azure-cli" arch="noarch">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="409454b28e2088db219499f0377a51d17ae36e1b20af2e982413812ffc13a323" name="azure-cli" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="6e896b24b2f90720f2dd0deb1ee8b2a0bf202519fd4d476293627742c6f29d1f" name="azure-cli" arch="noarch">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="f6a93ef4e6108153fe967c01407a1832123e2a30f00b4758ed761350dc19d8b0" name="azure-cli" arch="src">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="a9f904a235efbc1cf20ccac005fa1e9297411f3919e01013cd871cdb3cc665df" name="azure-cli-core" arch="noarch">
  <version epoch="0" ver="2.16.0" rel="6.10.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1579176000">- New upstream release
  + Version 2.0.80
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="meissner@suse.com" date="1580299200">- unrestrict python-PyYAML</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="ae01faf2d64677efc22615de84b3b0f2e46ea3da6d45ec05d53187382bc2c662" name="azure-cli-core" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.10.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1579176000">- New upstream release
  + Version 2.0.80
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="meissner@suse.com" date="1580299200">- unrestrict python-PyYAML</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="fe33fec8024827ef8e56d755f896b504f6f25d42f4eaf4718d449d93f5d40015" name="azure-cli-core" arch="noarch">
  <version epoch="0" ver="2.17.1" rel="150100.6.14.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Fix regression in patch to disable update check (bsc#1192671)
  + acc_disable-update-check.patch</changelog>
</package>
<package pkgid="0a9deff0378c1bff53044afd58db6f5c40e69e4dea71f008a35e5666e7b8f9c5" name="azure-cli-core" arch="src">
  <version epoch="0" ver="2.17.1" rel="150100.6.14.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Fix regression in patch to disable update check (bsc#1192671)
  + acc_disable-update-check.patch</changelog>
</package>
<package pkgid="b534cf45bc956cba5ed6475f3cfbf355aa05a85619afa9cc60e7846f4fc78799" name="azure-cli-test" arch="aarch64">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="2bd4ecde047a7d2613ed2f2ad021568157e6cf80fd1c60ac666d399e00fa3edb" name="azure-cli-test" arch="ppc64le">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="cd0331102ac64b3bd36f379081e97d168f1bf9c2efe23d474ae9ea9aef03f215" name="azure-cli-test" arch="s390x">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="8e28fcc104f5757f2bbdfc09730d69b029b2687731207481f4390c82a92e9180" name="azure-cli-test" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="9f03dcfe02aded346aec62af6c5d4fe29c13242a44de2c7ee98f64c842a64192" name="azure-cli-test" arch="x86_64">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="48e34dc48aecdbfbae13b5ea619b7d3fee4ad9f1d4fe6cfadf67564af7067f97" name="azure-cli-test" arch="aarch64">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="972777de9d01d8e5ce9834af610b863c6a695faeacbf0d7e2830810ca3d617d3" name="azure-cli-test" arch="ppc64le">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="b5223e71c1ef84e226c87ad9298d8b59b2dc1ee83299a7ffee2834aceacc86ca" name="azure-cli-test" arch="s390x">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="02d1e1d736ff55880d4af0c823ce9267b6c0ce1a37d49eeeae8ab690cbc936f0" name="azure-cli-test" arch="src">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="da7e8172c90601d54195496c0b688350eed73ee968749e86de17fad376411ee8" name="azure-cli-test" arch="x86_64">
  <version epoch="0" ver="2.17.1" rel="150100.6.11.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610107200">- New upstream release
  + Version 2.17.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635163200">- Update in SLE-15 (bsc#1189411, bsc#1191482)
- Add missing python-rpm-macros to BuildRequires</changelog>
</package>
<package pkgid="dfb16dac560f86922c5235e8b8a7ce02be35b2176b501089ffa634918efa0a00" name="babl" arch="src">
  <version epoch="0" ver="0.1.72" rel="3.2.1"/>
  <changelog author="jengelh@inai.de" date="1514721600">- Fix RPM groups. Drop comment about author extraction (not used
  for specfiles in general anymore).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516622400">- Update to version 0.1.40:
  + Added:
  - Format "CIE XYZ alpha" color model and formats;
  - Meson build; being tested in parallel with automake.
  + New API babl_process_rows for reduced overhead in some
    scenarios; though bigger gains seen also for regular
    babl_process with reimplemented branch-free dispatch, and
    faster cbrt.
  + Improved reference conversions for formats skipping some of
    models components.
  + Fixed gamma handling in indexed/palettized formats and improved
    gamma precision consistenct in sse2 conversions.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1516968000">- Update to version 0.1.42:
  + Fully initialize fishes when loading from cache.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520424000">- Update to version 0.1.44:
  + Fix bug in custom primaries/ICC fast paths, improve meson
    build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524052800">- Update to version 0.1.46:
  + Added extensions with more coverage for u32, half and other
    utilit fast paths.
  + Improving fast path coverage.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525780800">- Add baselibs.conf, build 32-bit support.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526472000">- Update to version 0.1.48:
  + Fix u8 &lt;-&gt; double conversions for chroma, SSE2 version of RGBA
    float to CIE L / Lab.
  + Build with -Ofast by default.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- Update to version 0.1.50:
  + Improvements to speed and precision of indexed code.
  + Improvements to mesonbuild.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1530792000">- Update to version 0.1.52:
  + Concurrency fixes and fixes to handling of 0/1 entry palettes.
  + Do not pre-equalize XYZ conversion matrices for sRGB.
  + Internal clean-ups.
  + Pre-define ACES2065-1 and ACEScg BablSpaces.
  + Add R~G~B~ set of spaces, which for all BablSpaces mean use
    sRGB TRC.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 0.1.56:
  + Improvements to the caching of profiled conversion chains
    between invocations by ignoring unknown bits in cache file and
    remember which conversions yielded reference fishes.
- Changes from version 0.1.54:
  + Export babl_space_get_icc, babl_space_get,
    babl_model_with_space, babl_space_with_trc,
    babl_format_get_encoding, babl_model_is, SSE2 versions of YA
    float and Y float to CIE L float.</changelog>
  <changelog author="idonmez@suse.com" date="1535630400">- Update license to LGPL-3.0-or-later AND GPL-3.0-or-later per the
  feedback from legal.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 0.1.58:
  + Preserve color of transparent pixels in conversion to
    premultiplied alpha.
  + Added single precision code-paths for faster fallback/reference
    conversions.
  + New BABL_ICC_INTENT_PERFORMANCE bitflag for combing with intent
    as bitflags.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543924800">- Update to version 0.1.60:
  + Improved thread safety, acceleration for R'G'B'A u8 -&gt;
    cairo-ARGB32 conversion.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1553083200">- Update to version 0.1.62:
  + Initial CMYK spaces with lcms2 based ICC support, much room for
    optimization.
  + Improved custom space support for palette formats.
  + scRGB space, works like sRGB but always with linear TRCs.
  + Model introspection API permitting low overhead checks whether
    a format/model is RGB, CMYK type of alpha and similar.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1558872000">- Update to version 0.1.64:
  + Support for Hygon Dhyana, and Y~aA formats for symmetric
    completeness.
  + Code consistency, gitlab CI, autotools and meson build
    improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560600000">- Update to version 0.1.66:
  + Added API call, babl_space_get_rgb_luminance.
  + Make most SIMD code-paths optional again on i686.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1564920000">- Update to version 0.1.70:
  + Build fixes making the meson build work with more
    architectures.
- Changes from version 0.1.68:
  + Added Yu'v' (CIE 1976 UCS) color model.
  + Fixed a severe non-initialised memory issue - that kept us from
    using fast paths for many babl spaces loaded from profile.
  + More fully symmetric conversions between associated and
    separate alpha.
  + Added more converters, both SSE2 and non-SSE2 for
    matrix-conversion between different RGB spaces.
  + Improvements to website/documentation; babl is now using the
    terms associated alpha and separate alpha, all of:
    nonpremultiplied-, premultiplied- and nonassociated- alpha are
    now considered deprecated API.
  + HCY luminance is now relative to the RGB space used - no change
    for sRGB related pixel formats. AVX2 acceleration for some
    linear to float conversions.
- Add meson BuildRequires and macros, upstream switched to meson
  only.
- Add pkgconfig(lcms2) BuildRequires: New dependency.
- Add babl-add-sse2_cflags-to-CIE.patch: Fix build for i586
  (glgo#GNOME/babl!42, glgo#GNOME/babl#23).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566561600">- Update to version 0.1.72:
  + Added handling for grayscale ICC profiles and gobject
    introspection support.
  + Optimizations for many format conversions for u8, u16 and half
    formats.
  + Fixed a crash for NANs in float to u8 conversions.
- Drop babl-add-sse2_cflags-to-CIE.patch: Fixed upstream.
- Add pkgconfig(gobject-introspection-1.0) BuildRequires: New
  dependency.
- Following the above, package new sub-package
  typelib-1_0-Babl-0_1.</changelog>
  <changelog author="jengelh@inai.de" date="1566561601">- Trim package descriptions on packages installed more rarely.</changelog>
</package>
<package pkgid="0691759030bfc72c84efc9b4662cff9c77a9d362ea080f4af6436f767361d9f6" name="babl-devel" arch="aarch64">
  <version epoch="0" ver="0.1.72" rel="3.2.1"/>
  <changelog author="jengelh@inai.de" date="1514721600">- Fix RPM groups. Drop comment about author extraction (not used
  for specfiles in general anymore).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516622400">- Update to version 0.1.40:
  + Added:
  - Format "CIE XYZ alpha" color model and formats;
  - Meson build; being tested in parallel with automake.
  + New API babl_process_rows for reduced overhead in some
    scenarios; though bigger gains seen also for regular
    babl_process with reimplemented branch-free dispatch, and
    faster cbrt.
  + Improved reference conversions for formats skipping some of
    models components.
  + Fixed gamma handling in indexed/palettized formats and improved
    gamma precision consistenct in sse2 conversions.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1516968000">- Update to version 0.1.42:
  + Fully initialize fishes when loading from cache.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520424000">- Update to version 0.1.44:
  + Fix bug in custom primaries/ICC fast paths, improve meson
    build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524052800">- Update to version 0.1.46:
  + Added extensions with more coverage for u32, half and other
    utilit fast paths.
  + Improving fast path coverage.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525780800">- Add baselibs.conf, build 32-bit support.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526472000">- Update to version 0.1.48:
  + Fix u8 &lt;-&gt; double conversions for chroma, SSE2 version of RGBA
    float to CIE L / Lab.
  + Build with -Ofast by default.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- Update to version 0.1.50:
  + Improvements to speed and precision of indexed code.
  + Improvements to mesonbuild.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1530792000">- Update to version 0.1.52:
  + Concurrency fixes and fixes to handling of 0/1 entry palettes.
  + Do not pre-equalize XYZ conversion matrices for sRGB.
  + Internal clean-ups.
  + Pre-define ACES2065-1 and ACEScg BablSpaces.
  + Add R~G~B~ set of spaces, which for all BablSpaces mean use
    sRGB TRC.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 0.1.56:
  + Improvements to the caching of profiled conversion chains
    between invocations by ignoring unknown bits in cache file and
    remember which conversions yielded reference fishes.
- Changes from version 0.1.54:
  + Export babl_space_get_icc, babl_space_get,
    babl_model_with_space, babl_space_with_trc,
    babl_format_get_encoding, babl_model_is, SSE2 versions of YA
    float and Y float to CIE L float.</changelog>
  <changelog author="idonmez@suse.com" date="1535630400">- Update license to LGPL-3.0-or-later AND GPL-3.0-or-later per the
  feedback from legal.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 0.1.58:
  + Preserve color of transparent pixels in conversion to
    premultiplied alpha.
  + Added single precision code-paths for faster fallback/reference
    conversions.
  + New BABL_ICC_INTENT_PERFORMANCE bitflag for combing with intent
    as bitflags.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543924800">- Update to version 0.1.60:
  + Improved thread safety, acceleration for R'G'B'A u8 -&gt;
    cairo-ARGB32 conversion.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1553083200">- Update to version 0.1.62:
  + Initial CMYK spaces with lcms2 based ICC support, much room for
    optimization.
  + Improved custom space support for palette formats.
  + scRGB space, works like sRGB but always with linear TRCs.
  + Model introspection API permitting low overhead checks whether
    a format/model is RGB, CMYK type of alpha and similar.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1558872000">- Update to version 0.1.64:
  + Support for Hygon Dhyana, and Y~aA formats for symmetric
    completeness.
  + Code consistency, gitlab CI, autotools and meson build
    improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560600000">- Update to version 0.1.66:
  + Added API call, babl_space_get_rgb_luminance.
  + Make most SIMD code-paths optional again on i686.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1564920000">- Update to version 0.1.70:
  + Build fixes making the meson build work with more
    architectures.
- Changes from version 0.1.68:
  + Added Yu'v' (CIE 1976 UCS) color model.
  + Fixed a severe non-initialised memory issue - that kept us from
    using fast paths for many babl spaces loaded from profile.
  + More fully symmetric conversions between associated and
    separate alpha.
  + Added more converters, both SSE2 and non-SSE2 for
    matrix-conversion between different RGB spaces.
  + Improvements to website/documentation; babl is now using the
    terms associated alpha and separate alpha, all of:
    nonpremultiplied-, premultiplied- and nonassociated- alpha are
    now considered deprecated API.
  + HCY luminance is now relative to the RGB space used - no change
    for sRGB related pixel formats. AVX2 acceleration for some
    linear to float conversions.
- Add meson BuildRequires and macros, upstream switched to meson
  only.
- Add pkgconfig(lcms2) BuildRequires: New dependency.
- Add babl-add-sse2_cflags-to-CIE.patch: Fix build for i586
  (glgo#GNOME/babl!42, glgo#GNOME/babl#23).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566561600">- Update to version 0.1.72:
  + Added handling for grayscale ICC profiles and gobject
    introspection support.
  + Optimizations for many format conversions for u8, u16 and half
    formats.
  + Fixed a crash for NANs in float to u8 conversions.
- Drop babl-add-sse2_cflags-to-CIE.patch: Fixed upstream.
- Add pkgconfig(gobject-introspection-1.0) BuildRequires: New
  dependency.
- Following the above, package new sub-package
  typelib-1_0-Babl-0_1.</changelog>
  <changelog author="jengelh@inai.de" date="1566561601">- Trim package descriptions on packages installed more rarely.</changelog>
</package>
<package pkgid="d9611628f0ba03bb7af68d68b761fc9a72ff550930611ad2d58a4201a0d88eee" name="babl-devel" arch="ppc64le">
  <version epoch="0" ver="0.1.72" rel="3.2.1"/>
  <changelog author="jengelh@inai.de" date="1514721600">- Fix RPM groups. Drop comment about author extraction (not used
  for specfiles in general anymore).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516622400">- Update to version 0.1.40:
  + Added:
  - Format "CIE XYZ alpha" color model and formats;
  - Meson build; being tested in parallel with automake.
  + New API babl_process_rows for reduced overhead in some
    scenarios; though bigger gains seen also for regular
    babl_process with reimplemented branch-free dispatch, and
    faster cbrt.
  + Improved reference conversions for formats skipping some of
    models components.
  + Fixed gamma handling in indexed/palettized formats and improved
    gamma precision consistenct in sse2 conversions.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1516968000">- Update to version 0.1.42:
  + Fully initialize fishes when loading from cache.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520424000">- Update to version 0.1.44:
  + Fix bug in custom primaries/ICC fast paths, improve meson
    build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524052800">- Update to version 0.1.46:
  + Added extensions with more coverage for u32, half and other
    utilit fast paths.
  + Improving fast path coverage.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525780800">- Add baselibs.conf, build 32-bit support.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526472000">- Update to version 0.1.48:
  + Fix u8 &lt;-&gt; double conversions for chroma, SSE2 version of RGBA
    float to CIE L / Lab.
  + Build with -Ofast by default.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- Update to version 0.1.50:
  + Improvements to speed and precision of indexed code.
  + Improvements to mesonbuild.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1530792000">- Update to version 0.1.52:
  + Concurrency fixes and fixes to handling of 0/1 entry palettes.
  + Do not pre-equalize XYZ conversion matrices for sRGB.
  + Internal clean-ups.
  + Pre-define ACES2065-1 and ACEScg BablSpaces.
  + Add R~G~B~ set of spaces, which for all BablSpaces mean use
    sRGB TRC.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 0.1.56:
  + Improvements to the caching of profiled conversion chains
    between invocations by ignoring unknown bits in cache file and
    remember which conversions yielded reference fishes.
- Changes from version 0.1.54:
  + Export babl_space_get_icc, babl_space_get,
    babl_model_with_space, babl_space_with_trc,
    babl_format_get_encoding, babl_model_is, SSE2 versions of YA
    float and Y float to CIE L float.</changelog>
  <changelog author="idonmez@suse.com" date="1535630400">- Update license to LGPL-3.0-or-later AND GPL-3.0-or-later per the
  feedback from legal.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 0.1.58:
  + Preserve color of transparent pixels in conversion to
    premultiplied alpha.
  + Added single precision code-paths for faster fallback/reference
    conversions.
  + New BABL_ICC_INTENT_PERFORMANCE bitflag for combing with intent
    as bitflags.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543924800">- Update to version 0.1.60:
  + Improved thread safety, acceleration for R'G'B'A u8 -&gt;
    cairo-ARGB32 conversion.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1553083200">- Update to version 0.1.62:
  + Initial CMYK spaces with lcms2 based ICC support, much room for
    optimization.
  + Improved custom space support for palette formats.
  + scRGB space, works like sRGB but always with linear TRCs.
  + Model introspection API permitting low overhead checks whether
    a format/model is RGB, CMYK type of alpha and similar.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1558872000">- Update to version 0.1.64:
  + Support for Hygon Dhyana, and Y~aA formats for symmetric
    completeness.
  + Code consistency, gitlab CI, autotools and meson build
    improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560600000">- Update to version 0.1.66:
  + Added API call, babl_space_get_rgb_luminance.
  + Make most SIMD code-paths optional again on i686.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1564920000">- Update to version 0.1.70:
  + Build fixes making the meson build work with more
    architectures.
- Changes from version 0.1.68:
  + Added Yu'v' (CIE 1976 UCS) color model.
  + Fixed a severe non-initialised memory issue - that kept us from
    using fast paths for many babl spaces loaded from profile.
  + More fully symmetric conversions between associated and
    separate alpha.
  + Added more converters, both SSE2 and non-SSE2 for
    matrix-conversion between different RGB spaces.
  + Improvements to website/documentation; babl is now using the
    terms associated alpha and separate alpha, all of:
    nonpremultiplied-, premultiplied- and nonassociated- alpha are
    now considered deprecated API.
  + HCY luminance is now relative to the RGB space used - no change
    for sRGB related pixel formats. AVX2 acceleration for some
    linear to float conversions.
- Add meson BuildRequires and macros, upstream switched to meson
  only.
- Add pkgconfig(lcms2) BuildRequires: New dependency.
- Add babl-add-sse2_cflags-to-CIE.patch: Fix build for i586
  (glgo#GNOME/babl!42, glgo#GNOME/babl#23).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566561600">- Update to version 0.1.72:
  + Added handling for grayscale ICC profiles and gobject
    introspection support.
  + Optimizations for many format conversions for u8, u16 and half
    formats.
  + Fixed a crash for NANs in float to u8 conversions.
- Drop babl-add-sse2_cflags-to-CIE.patch: Fixed upstream.
- Add pkgconfig(gobject-introspection-1.0) BuildRequires: New
  dependency.
- Following the above, package new sub-package
  typelib-1_0-Babl-0_1.</changelog>
  <changelog author="jengelh@inai.de" date="1566561601">- Trim package descriptions on packages installed more rarely.</changelog>
</package>
<package pkgid="a54ed9bccdc83dcbd4fba1aa25529e6dd9584b7ee6e07f010a44b3aeefe6300c" name="babl-devel" arch="s390x">
  <version epoch="0" ver="0.1.72" rel="3.2.1"/>
  <changelog author="jengelh@inai.de" date="1514721600">- Fix RPM groups. Drop comment about author extraction (not used
  for specfiles in general anymore).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516622400">- Update to version 0.1.40:
  + Added:
  - Format "CIE XYZ alpha" color model and formats;
  - Meson build; being tested in parallel with automake.
  + New API babl_process_rows for reduced overhead in some
    scenarios; though bigger gains seen also for regular
    babl_process with reimplemented branch-free dispatch, and
    faster cbrt.
  + Improved reference conversions for formats skipping some of
    models components.
  + Fixed gamma handling in indexed/palettized formats and improved
    gamma precision consistenct in sse2 conversions.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1516968000">- Update to version 0.1.42:
  + Fully initialize fishes when loading from cache.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520424000">- Update to version 0.1.44:
  + Fix bug in custom primaries/ICC fast paths, improve meson
    build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524052800">- Update to version 0.1.46:
  + Added extensions with more coverage for u32, half and other
    utilit fast paths.
  + Improving fast path coverage.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525780800">- Add baselibs.conf, build 32-bit support.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526472000">- Update to version 0.1.48:
  + Fix u8 &lt;-&gt; double conversions for chroma, SSE2 version of RGBA
    float to CIE L / Lab.
  + Build with -Ofast by default.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- Update to version 0.1.50:
  + Improvements to speed and precision of indexed code.
  + Improvements to mesonbuild.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1530792000">- Update to version 0.1.52:
  + Concurrency fixes and fixes to handling of 0/1 entry palettes.
  + Do not pre-equalize XYZ conversion matrices for sRGB.
  + Internal clean-ups.
  + Pre-define ACES2065-1 and ACEScg BablSpaces.
  + Add R~G~B~ set of spaces, which for all BablSpaces mean use
    sRGB TRC.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 0.1.56:
  + Improvements to the caching of profiled conversion chains
    between invocations by ignoring unknown bits in cache file and
    remember which conversions yielded reference fishes.
- Changes from version 0.1.54:
  + Export babl_space_get_icc, babl_space_get,
    babl_model_with_space, babl_space_with_trc,
    babl_format_get_encoding, babl_model_is, SSE2 versions of YA
    float and Y float to CIE L float.</changelog>
  <changelog author="idonmez@suse.com" date="1535630400">- Update license to LGPL-3.0-or-later AND GPL-3.0-or-later per the
  feedback from legal.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 0.1.58:
  + Preserve color of transparent pixels in conversion to
    premultiplied alpha.
  + Added single precision code-paths for faster fallback/reference
    conversions.
  + New BABL_ICC_INTENT_PERFORMANCE bitflag for combing with intent
    as bitflags.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543924800">- Update to version 0.1.60:
  + Improved thread safety, acceleration for R'G'B'A u8 -&gt;
    cairo-ARGB32 conversion.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1553083200">- Update to version 0.1.62:
  + Initial CMYK spaces with lcms2 based ICC support, much room for
    optimization.
  + Improved custom space support for palette formats.
  + scRGB space, works like sRGB but always with linear TRCs.
  + Model introspection API permitting low overhead checks whether
    a format/model is RGB, CMYK type of alpha and similar.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1558872000">- Update to version 0.1.64:
  + Support for Hygon Dhyana, and Y~aA formats for symmetric
    completeness.
  + Code consistency, gitlab CI, autotools and meson build
    improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560600000">- Update to version 0.1.66:
  + Added API call, babl_space_get_rgb_luminance.
  + Make most SIMD code-paths optional again on i686.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1564920000">- Update to version 0.1.70:
  + Build fixes making the meson build work with more
    architectures.
- Changes from version 0.1.68:
  + Added Yu'v' (CIE 1976 UCS) color model.
  + Fixed a severe non-initialised memory issue - that kept us from
    using fast paths for many babl spaces loaded from profile.
  + More fully symmetric conversions between associated and
    separate alpha.
  + Added more converters, both SSE2 and non-SSE2 for
    matrix-conversion between different RGB spaces.
  + Improvements to website/documentation; babl is now using the
    terms associated alpha and separate alpha, all of:
    nonpremultiplied-, premultiplied- and nonassociated- alpha are
    now considered deprecated API.
  + HCY luminance is now relative to the RGB space used - no change
    for sRGB related pixel formats. AVX2 acceleration for some
    linear to float conversions.
- Add meson BuildRequires and macros, upstream switched to meson
  only.
- Add pkgconfig(lcms2) BuildRequires: New dependency.
- Add babl-add-sse2_cflags-to-CIE.patch: Fix build for i586
  (glgo#GNOME/babl!42, glgo#GNOME/babl#23).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566561600">- Update to version 0.1.72:
  + Added handling for grayscale ICC profiles and gobject
    introspection support.
  + Optimizations for many format conversions for u8, u16 and half
    formats.
  + Fixed a crash for NANs in float to u8 conversions.
- Drop babl-add-sse2_cflags-to-CIE.patch: Fixed upstream.
- Add pkgconfig(gobject-introspection-1.0) BuildRequires: New
  dependency.
- Following the above, package new sub-package
  typelib-1_0-Babl-0_1.</changelog>
  <changelog author="jengelh@inai.de" date="1566561601">- Trim package descriptions on packages installed more rarely.</changelog>
</package>
<package pkgid="ede9554acfb3cefe7a8030579b97f8c4ae305052fbc6c6105535a5655daf3665" name="babl-devel" arch="x86_64">
  <version epoch="0" ver="0.1.72" rel="3.2.1"/>
  <changelog author="jengelh@inai.de" date="1514721600">- Fix RPM groups. Drop comment about author extraction (not used
  for specfiles in general anymore).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516622400">- Update to version 0.1.40:
  + Added:
  - Format "CIE XYZ alpha" color model and formats;
  - Meson build; being tested in parallel with automake.
  + New API babl_process_rows for reduced overhead in some
    scenarios; though bigger gains seen also for regular
    babl_process with reimplemented branch-free dispatch, and
    faster cbrt.
  + Improved reference conversions for formats skipping some of
    models components.
  + Fixed gamma handling in indexed/palettized formats and improved
    gamma precision consistenct in sse2 conversions.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1516968000">- Update to version 0.1.42:
  + Fully initialize fishes when loading from cache.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520424000">- Update to version 0.1.44:
  + Fix bug in custom primaries/ICC fast paths, improve meson
    build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524052800">- Update to version 0.1.46:
  + Added extensions with more coverage for u32, half and other
    utilit fast paths.
  + Improving fast path coverage.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525780800">- Add baselibs.conf, build 32-bit support.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526472000">- Update to version 0.1.48:
  + Fix u8 &lt;-&gt; double conversions for chroma, SSE2 version of RGBA
    float to CIE L / Lab.
  + Build with -Ofast by default.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- Update to version 0.1.50:
  + Improvements to speed and precision of indexed code.
  + Improvements to mesonbuild.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1530792000">- Update to version 0.1.52:
  + Concurrency fixes and fixes to handling of 0/1 entry palettes.
  + Do not pre-equalize XYZ conversion matrices for sRGB.
  + Internal clean-ups.
  + Pre-define ACES2065-1 and ACEScg BablSpaces.
  + Add R~G~B~ set of spaces, which for all BablSpaces mean use
    sRGB TRC.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 0.1.56:
  + Improvements to the caching of profiled conversion chains
    between invocations by ignoring unknown bits in cache file and
    remember which conversions yielded reference fishes.
- Changes from version 0.1.54:
  + Export babl_space_get_icc, babl_space_get,
    babl_model_with_space, babl_space_with_trc,
    babl_format_get_encoding, babl_model_is, SSE2 versions of YA
    float and Y float to CIE L float.</changelog>
  <changelog author="idonmez@suse.com" date="1535630400">- Update license to LGPL-3.0-or-later AND GPL-3.0-or-later per the
  feedback from legal.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 0.1.58:
  + Preserve color of transparent pixels in conversion to
    premultiplied alpha.
  + Added single precision code-paths for faster fallback/reference
    conversions.
  + New BABL_ICC_INTENT_PERFORMANCE bitflag for combing with intent
    as bitflags.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543924800">- Update to version 0.1.60:
  + Improved thread safety, acceleration for R'G'B'A u8 -&gt;
    cairo-ARGB32 conversion.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1553083200">- Update to version 0.1.62:
  + Initial CMYK spaces with lcms2 based ICC support, much room for
    optimization.
  + Improved custom space support for palette formats.
  + scRGB space, works like sRGB but always with linear TRCs.
  + Model introspection API permitting low overhead checks whether
    a format/model is RGB, CMYK type of alpha and similar.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1558872000">- Update to version 0.1.64:
  + Support for Hygon Dhyana, and Y~aA formats for symmetric
    completeness.
  + Code consistency, gitlab CI, autotools and meson build
    improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560600000">- Update to version 0.1.66:
  + Added API call, babl_space_get_rgb_luminance.
  + Make most SIMD code-paths optional again on i686.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1564920000">- Update to version 0.1.70:
  + Build fixes making the meson build work with more
    architectures.
- Changes from version 0.1.68:
  + Added Yu'v' (CIE 1976 UCS) color model.
  + Fixed a severe non-initialised memory issue - that kept us from
    using fast paths for many babl spaces loaded from profile.
  + More fully symmetric conversions between associated and
    separate alpha.
  + Added more converters, both SSE2 and non-SSE2 for
    matrix-conversion between different RGB spaces.
  + Improvements to website/documentation; babl is now using the
    terms associated alpha and separate alpha, all of:
    nonpremultiplied-, premultiplied- and nonassociated- alpha are
    now considered deprecated API.
  + HCY luminance is now relative to the RGB space used - no change
    for sRGB related pixel formats. AVX2 acceleration for some
    linear to float conversions.
- Add meson BuildRequires and macros, upstream switched to meson
  only.
- Add pkgconfig(lcms2) BuildRequires: New dependency.
- Add babl-add-sse2_cflags-to-CIE.patch: Fix build for i586
  (glgo#GNOME/babl!42, glgo#GNOME/babl#23).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566561600">- Update to version 0.1.72:
  + Added handling for grayscale ICC profiles and gobject
    introspection support.
  + Optimizations for many format conversions for u8, u16 and half
    formats.
  + Fixed a crash for NANs in float to u8 conversions.
- Drop babl-add-sse2_cflags-to-CIE.patch: Fixed upstream.
- Add pkgconfig(gobject-introspection-1.0) BuildRequires: New
  dependency.
- Following the above, package new sub-package
  typelib-1_0-Babl-0_1.</changelog>
  <changelog author="jengelh@inai.de" date="1566561601">- Trim package descriptions on packages installed more rarely.</changelog>
</package>
<package pkgid="015ca479d8ba100641b1569534cbefba1316e128f18617aecde60a7440fc148a" name="bash" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="9fb97fd71b407d21d10854f336fb3e7ec3b7d7915a9309ce862c9c80b645bdfa" name="bash" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="e8d77dfac449aa91e462a4860fd73b5ef9e0711f9a69a98cf97f2756d90e56c9" name="bash" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="528beb859b071a41a159e4f598df625ab3e16b4c77f51d1e1180e222e381c0d8" name="bash" arch="src">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="a73af5591830c8f75dd02477714ee709e697570e40de22a73c9be802404cfe15" name="bash" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="aa284b083d5f8b4450edc214288f91be2bbc93f0eaf551c520978de4bd629c23" name="bash" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to 
[file cut: first 33554432 bytes kept]
[document cut: first 32053067 of 33554196 characters kept]
